Hallo,
vielleicht kann mir jemand weiterhelfen. Ich möchte meine Seite durch einen PCI Compliance Check durchbringen. Allerdings ergibt der Check immer FAIL. Anscheinend gibt es von den Standard Cookie was Joomla setzt ein Sicherheitsproblem. Die Anwendung scheint Cookies (wahrscheinlich Sitzungs-IDs) auf unsichere Weise zu verwenden. Ich habe ein frische Joomla (3.10.8) Instanz ohne Plugins etc. aufgesetzt und da entstand schon das Problem. Ist es Möglich die Standard Cookies von Joomla zu deaktivieren?
PHP 5.5.9-1ubuntu4.22
PCI Scan Vulnerability Scan Report / Sysnet - Qualys:
THREAT:
The scanner found a Web application on the target that uses cookies. The application seems to use cookies (likely, session IDs) in an insecure way. Specifically, the scanner created a web session with the target using a session ID specified by the scanner itself. The target application simply started a new session with this specified session ID. This issue is generally called "session-fixation" and is vulnerable to session-hijacking attacks.
One scenario where this could be used to hijack an unsuspecting user's Web session is as follows. Assuming an online store, http://www.examplestore.com, has this security issue. If an attacker uses social engineering techniques to make a target user click on a link (in an email or on a malicious Web site) like http://www.examplestore.com/? PHPSESSID=12345, where PHPSESSID is the cookie used for identifying the session, the store will start a new session for the unsuspecting user with the session ID 12345. Then, since the attacker knows the session ID already, the attacker can simply hijack the session moments after the user has visited the store.
IMPACT:
By exploiting this vulnerability, an attacker could use the hijacked session for information gathering, invasion of privacy, property theft, or credit-card theft. For more information about the way session-fixation attacks can be performed and the possible consequences of such attacks, read this paper.
SOLUTION:
This is a common issue web-developers come across, and many application-specific solutions exist.
The PHP package itself provides a "php.ini" based global configuration option called "session.use_only_cookies" (introduced in PHP Version 4.3.0). This is disabled by default for backward compatibility. When enabled, this allows PHP session IDs to be set only via HTTP cookies. This makes GET/POST based hijack attacks possible only when there is significant activity by an unsuspecting user.
For more information, read the Sessions and Security description provided on PHP's Web site.
For solutions in other web packages, check the relevant documentation.
RESULT:
GET /?b4ddaaa3cfb97f846cbcae230511344f=0123456789abcdef0123456789abcdef HTTP/1.0
Host: ####
