HP's fortify on demand security review: "Session Token Passed in Query String"

HP's fortify on demand security review: "Session Token Passed in Query String"

by Franco Pomidoro -
Number of replies: 4

Hello everybody,

A client has corporate guidelines that require all apps to be installed on their servers and to pass a thorough security check. They use HP's Fortify On Demand security software for their security reviews.

So far we were able to solve all the "issues" detected by this software but one: "Session Token Passed in Query String" (Medium). I've attached a .doc file with the detailed issue information as provided by HP's software.

The recommendation of the software is:

The application should use an alternative mechanism for transmitting session tokens, such as HTTP cookies or hidden fields in forms that are submitted using the POST method, preferably with encryption enabled.

Although it's a medium issue they are asking us to solve it to move forward so we must somehow solve it, or provide a technical explanation explaining why it does not apply.

I found this doc about sesskey https://docs.moodle.org/dev/Security:Cross-site_request_forgery but I was unable to find more info nor have I found anything on the forums related to a similar situation from other member of the community.

As far as I understand Moodle is not using sesskey for transmitting session tokens (as the review software implies) but to validate what is being transmitted using HTTP cookies so this "issue" would not apply.

Can somebody help me with a more detailed technical explanation as to why this "issue" would not apply to Moodle (if that's the case) or how to, if possible, modify Moodle to comply?

Thanks!

Average of ratings: -
In reply to Franco Pomidoro

Re: HP's fortify on demand security review: "Session Token Passed in Query String"

by Andrea Bicciolo -

Hello Franco,

according to the hint provided, "The application should use an alternative mechanism for transmitting session tokens, such as HTTP cookies...", I think you could configure http cookies in Moodle accessing "Site administration >  Security >  HTTP security" and activating "Only http cookies | cookiehttponly".

Depending on your requirements, you may also want to explore the possibility to entirely run your Moodle site under https.

Average of ratings: -
In reply to Franco Pomidoro

Re: HP's fortify on demand security review: "Session Token Passed in Query String"

by Tim Hunt -
Picture of Core developers Picture of Documentation writers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers

Moodle does only use cookies for session ids.

sesskey is something else. Your reading of that docs page is correct. In this case your security reviewers are misunderstanding how Moodle works. There is no issue here.

Average of ratings: Useful (2)
In reply to Tim Hunt

Re: HP's fortify on demand security review: "Session Token Passed in Query String"

by Dan Marsden -
Picture of Core developers Picture of Particularly helpful Moodlers Picture of Peer reviewers Picture of Plugin developers Picture of Plugins guardians Picture of Testers Picture of Translators

That is a really common mistake from security researchers looking at Moodle - I see a handful of these reports every year. it's partly our fault for calling that param "sesskey" - if we'd called it something else like "csrfprotect" it might avoid these reports! - you have found the relevant doc already but here's a response I usually use when responding to these people that might be useful.

The sesskey in the url is NOT the PHP or Moodle Session - it does not allow authentication.

Moodle sesskey is an extra security layer to help prevent CSRF -see http://docs.moodle.org/dev/Security:Cross-site_request_forgery#Session_key


Usually that response is enough for a security researcher to understand.

Average of ratings: Useful (6)
In reply to Dan Marsden

Re: HP's fortify on demand security review: "Session Token Passed in Query String"

by Franco Pomidoro -

Hello Dan, thanks! I'll based my answer on your comments.

Tim, Andrea, thanks for your inputs as well, they all help me write a proper answer based on useful information.

Thanks again!

Average of ratings: -