QID 153003

Date Published: 2023-07-25

QID 153003: Ruby On Rails - Insufficient Session Expiration

Session timeout is the period of inactivity after which a user's session on a website or application is automatically ended, requiring them to log in again for security reasons.

QID detected that the web application is using a overly long session timeout.
A long expiration time increases an attacker's chance of successfully guessing a valid session ID. The longer the expiration time, the more concurrent open sessions will exist at any given time. The larger the pool of sessions, the more likely it will be for an attacker to guess one at random. Although a short session inactivity timeout does not help if a token is immediately used, the short timeout helps to insure that the token is harder to capture while it is still valid.

Session timeouts greater than 30 minutes are not recommended as they provide attackers more time to complete attacks and exploits. Specifically, overly long sessions make applications more susceptible to session hijacking and cross-user web attacks, such as Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS).

CVSS V3 rated as High - 7.3 severity.

CVSS V2 rated as High - 7.5 severity.

Solution

To mitigate this risk, you can set a shorter expiration time for the cookie, use a secure cookie, or use a session management framework that implements proper session expiration. You can also monitor your web application for signs of session hijacking attacks.

Vendor References

CVEs related to QID 153003

Software Advisories

Advisory ID	Software	Component	Link

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].