PHP Inject in another users session

Question

Hello,

Since every user has a unique PHPSESSID, is it possible for two users, say a to inject info into b's SESSION data using standard PHP running on the server.

Note, I am not using this for any wrong purposes. Trying to use it for chatting without DB access.

Thank you for your time.

Answer 1

Read up on session fixation

Answer 2

I can't say for sure but since session data is by default stored in a file, if your app knows the session id of the other user you could replace in the session file that was written by the standard session functions with altered data. The next time the other user accesses a script the altered session data will be loaded.

But you are risking all sorts of race conditions and conflicts if you just do this on top of the built in session handling. You will probably want to replace the session handling functions with your own so you can deal with all of these issues. The issues are probably much more complex than they appear on the surface.

See: http://www.php.net/manual/en/session.customhandler.php for information about custom session handlers

Answer 3

I'm assuming you want to somehow have A chat to B by sending a message which gets placed into B's session.

First of all, A needs to learn B's session ID, perhaps by selecting their name from a list. You'll almost certainly want to encrypt these session ids, otherwise you have created a nice security hole!

So, A posts data to the server containing the target session id, and a message. Here's how we could temporary switch session ids to write that data into the target session:

//get data from form - I'll leave the encryption of the target
//session id up to you!
$target_session_id=decryptSessionId($_POST['target']);
$message=strip_tags($_POST['message']);

//remember our "real" session id and close the session
$original_session_id=session_id();
session_write_close();

//open the target session
session_id($target_session_id);
session_start();

//add message to target session
$_SESSION['chat'][]=$message;

//close target session
session_write_close();


//reopen the "real" session
session_id($original_session_id);
session_start();

Answer 4

PHP’s default session handler uses only the session ID to identify the session. That makes it possible to use the session ID from another user and thus use the same session (Session Hijacking). Another attack is to prepare a session and get the victim to use that session so that the victim and attacker again use the same session (Session fixation).

The base for such attacks is that you just need to know the session ID to use the session that is associated to it. Prevention techniques are to use more identification information than just the session ID. Some suggest to use the IP address (but that may change during a session) or the user agent identifier. Another technique is to hide the session ID externally by allowing only a cookie and HTTPS.

But be also aware of shared hosting. Some might use a common pool for all session data files of all cumstomers.

Answer 5

Session is a simple thing that can be easily reimplemented to do as you wish. Take a look at this simple exemple I wrote some time ago: http://pastebin.com/f3ca0ae8d

Usage:

• new mySession(); doing the same as session_start();
• $_MYSESSION doing the same as $_SESSION
• delete mySession(); doing the same as session_write_close(); not necessary to use unless you want to release the session before the script end.

You can make some adaptations to use it in your specific purpose, like defining the session ID yourself so you can share it among different users. As $_MYSESSION will be common among users, you can also use regular PHP Sessions together with it to store user specific information in $_SESSION.

[Edit]

http://pastebin.com/f3c31737e

Exemple: Enter the channel $_SESSION['channelid'] and print all unread lines.

session_start();
new mySession($_SESSION['channelid']);

while (count($_MYSESSION['chat']) > 100) unset($_MYSESSION['chat'][key($_MYSESSION['chat'])]);

while ($line = $_MYSESSION['chat'][$_SESSION['lastread']++])
        echo "$line
";

Exemple: Talk to the channel.

session_start();
new mySession($_SESSION['channelid']);

$_MYSESSION['chat'][] = $_SESSION['myname'] . ' says, "' . htmlspecialchars($_POST['message']) . '"';

etc...

Answer 6

Instead of farting around with what is, essentially, indirect file handling through the session system, why not go straight to the point and use text files?

It's less vulnerable to attacks, and also less volatile, in the sense that future versions of PHP could decide to prevent this sort of session switching for security reasons (complete hypothetical, but it makes sense).