0

I am passing the Cookie header of a valid authenticated, high privileged user to the unauthenticated or low privileged user using Autorize (Burp Extension).

So ideally, the Autorize says the requests are bypassed because the Cookie header is now changed. This can also be manually performed in the Browser's Application tab.

Is this considered to be a vulnerability given the fact that those two different accounts are mine and I know the actual session ID of both the users? (Not sniffed or hijacked)

enter image description here

3
  • 1
    I find your question hard to understand. It would benefit greatly from some requests or screenshots
    – user163495
    Apr 16 at 1:51
  • @MechMK1 I have two users on a website - User A and User B in different sessions. I am replacing User A's session ID with User B's session ID. Now I am logged in as User A in the website. This I performed using Autorize - Burp Extension. Is this a potential vulnerability or an expected behavior?
    – Supraja
    Apr 16 at 2:29
  • @MechMK1 As I am aware of both the user sessions and thus, able to modify them and did not hijack them. So I was curious if this is how it works or if a potential attack can be performed using this.
    – Supraja
    Apr 16 at 2:31

1 Answer 1

0

Your application uses session ID in cookie to manage session. As you can find in OWASP Cheat Sheet Series:

In order to keep the authenticated state and track the users progress within the web application, applications provide users with a session identifier (session ID or token) that is assigned at session creation time, and is shared and exchanged by the user and the web application for the duration of the session (it is sent on every HTTP request). The session ID is a name=value pair.

If your application uses cookie to manage session:

  • User A's session ID -> logged in as User A
  • User B's session ID -> logged in as User B

If you use user B's session ID and you see user A's account that can be a vulnerability, but did you set enforcement detector filters correctly? Autorize need to know how to assess results correctly. More about enforcement detector configuration https://github.com/portswigger/autorize:

The enforcement detector filters will allow Autorize to detect authentication and authorization enforcement in the response of the server by content length or string (literal string or regex) in the message body, headers or in the full request.

Did you check in "Request/Response Viewers" that your request was really sent with user B's cookie?

For Burp there is also Auth Matrix extension that can help you with IDOR vulnerabilities. I personally find this extension more user-friendly (but the functionality of course is very similar).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.