Objects stored in a HttpSessionState session are stored on the server-side. They can only be accessed by your application code, not by the client (the browser) or the user using the browser like a client-side storage mechanism (like cookies) might allow.
So, there is no direct way for a user to tamper with or modify the value of session objects. The only way a malicious user can abuse session state would be to steal an entire sesssion, which is known as a session hijacking attack, or force a victim user to use a specific session, which is known as a session fixation attack. This is accomplished by taking the value of a cookie that is sent to the browser that identifies the session a user is associated with, so that it can be accessed on subsequent requests. If a malicious user can steal another user's session cookie/id or force another use to use the attackers previously established session id, (often relying on separate cross-site-scripting attacks to accomplish) the attacker than then either impersonate the victim, or get the victim to perform an action on the attacker's behalf.
Even in these cases, however, the attacker is limited to the transfer of the session in its entirety. He or she still has no control over the values of the properties stored server-side for the session.