Session cookies in WLUS (was: test case 009 add one user)
(i moved this discussion to debian-edu@l.d.o, because it has both
english language and is relevant to development. the
norwegians/skandinavians on the user list might not be
interested.)
* Morten Arnesen (mort1arn@online.no) [040410 15:56]:
> i ran a test on case 009 delete one user.
>
> the test concluded with error, deletion whithout adminpasswd.
the session cookie i issue for saving the state lasts 5 minutes,
just as the default of webmin's cookie which determines if one is
logged in needs to authenticate newly.
session cookies allow for this attack:
admin logs in and authenticates.
admin does GoodStuff.
admin leaves website and place, browser still open.
EvilGuy comes before webmin`s session cookie expires, hits the
back button until he comes to the webmin page again and does
EvilStuff.
The session cookie belongs to the open webbrowser. it has nothing
to do with leaving the webpage or so. we wont get rid of the
webmin session cookie, it is part of webmin. how evil is it to
use a WLUS session cookie for a similar purpose, and allowing for
a similar attack?
Reply to: