How Easy Is It to Hijack Session Vars on GoDaddy (PHP)

Question

This article states that

If your site is run on a shared Web server, be aware that any session variables can easily be viewed by any other users on the same server.

On a larger host like GoDaddy, are there really no protections in place against this? Could it really be that easy? If it is that easy, where are the session vars of the other users on my host so I can check them out?

Edit: I didn't believe it, but here's my little program which shows that this is true! I wonder if those are really the same as the value stored in the cookies on the users' machine?

Answer 1

The session files by default are stored in the location given by the session.save_path in php.ini. While this can be defined separately for each vhost, the files have to be readable by the httpd process, and so if you know the location, your script could read the session files from another vhost.

You could store your sessions in a database (for example, using ADODb), assuming other users of the server can't read your PHP sources to learn your db credentials!

Answer 2

It is ridiculously easy because by default php.ini#session.save_path points to /tmp on Linux installs and similar for Windows. This is bad because most users have read and write privileges to /tmp because they need them. You can protect against this by storing your sesion state in the database or by changing were your PHP application stores it's session files, using session_save_path

Answer 3

If you're using PHP and worried about session hijacking, check out session_regenerate_id (Link to Manual).

This won't solve the problem of the session_save paths being public as mentioned by others here, but it should prevent 99.999% of hijacking attmepts.

Answer 4

use session.save_path to set, save, and handle your visitors sessions only within your account space whenever you are on a shard host.

then no one but you and your hosts employees with directory access can access them.

NEVER rely on default session handlers/location on a shared host!

<?php

        $handle = opendir(session_save_path());
        if ($handle == false)
            {
                return -1;
            }
        while (($file = readdir($handle)) !== false)
            {
                echo session_save_path() . '/' . $file .':<BR />';
                if (ereg("^sess", $file))
                    {
                        $file_array = file(session_save_path() . '/' . $file);
                        foreach ($file_array as $this_line)
                            {
                                echo $this_line."<BR />";
                            }
                echo '<BR /><BR />';

                    }
            }
        closedir($handle);

?>

Answer 5

I suggesst you to store session data in DB to avoid these problems, it has the additional benefit to ease accesss live information from user's sessions.