Patch session fixation vulnerability

[Arinerron]

This is the pull request for the first vuln I reported. I'm not entirely sure about the second one yet because I don't know where the csrf token for the user is stored/how you'd want it.

Here's the documentation for that function:
http://php.net/manual/en/function.session-regenerate-id.php

And here's about session fixation:
https://www.owasp.org/index.php/Session_fixation

[dpeca]

Do you tested patched code?
Does it generate new seesion id ?

[Arinerron]

@dpeca I don't have an installation to test it on, but I made a page to test the function session_regenerate_id that was added:

<?php
session_start(); // start session
$_SESSION['test'] = "hello";

echo "before " . $_SESSION['test'] . " && sessid=" . session_id() . "\n";

session_regenerate_id(); // regenerate sessionid

echo "after " . $_SESSION['test'] . " && sessid=" . session_id();
?>

Here's the output:

before hello && sessid=9rvpritmpvka272thk36kcnip3
after hello && sessid=tdvnjcoalbaftunu5scqhe9ek0

As you can see, the session ID changed, but the data that the session stored remained intact.

[anton-reutov]

The commit should be checked by Serghey Rodin or Dmitry Naumov-Socolov

[naumov-socolov]

thanks @Arinerron

[Arinerron]

np. Mind if I request a cve id?

…

On Mon, Feb 27, 2017, 2:27 PM naumov-socolov ***@***.***> wrote: thanks @Arinerron <https://github.com/Arinerron> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#1101 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ADvq4Rz9o9liUcBEDgNShgFOf4G0SBlDks5rg03agaJpZM4MMmzS> .

[naumov-socolov]

sure

…

On Tue, Feb 28, 2017 at 1:11 AM, Arinerron ***@***.***> wrote: np. Mind if I request a cve id? On Mon, Feb 27, 2017, 2:27 PM naumov-socolov ***@***.***> wrote: > thanks @Arinerron <https://github.com/Arinerron> > > — > You are receiving this because you were mentioned. > > > Reply to this email directly, view it on GitHub > <#1101 (comment) >, > or mute the thread > <https://github.com/notifications/unsubscribe-auth/ ADvq4Rz9o9liUcBEDgNShgFOf4G0SBlDks5rg03agaJpZM4MMmzS> > . > — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#1101 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAz5zsv5MnXjvasyM_iKVBECqQP4y_y8ks5rg1gdgaJpZM4MMmzS> .

[Arinerron]

CVE id: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6365