Is Session Prediction Possible in Liferay

Issue

• Is it possible an attacker could predict the JSESSIONID and gain unauthorized access, referencing an example from a 'Session Prediction' article?

• Explanation of Issue Using the "Catalog" Page in Postman:

  • If a user uses the "owner cookie" to access the "Catalog" page via Postman, the request incorporates the owner's session, which includes view permissions. As a result, the "Catalog" page becomes visible in Postman.
    • Steps to check:
      1. Logged into the portal.
      2. Created a commerce site named 'Speedwell'.
      3. Removed the view permission for the guest user for the 'Catalog' page.
      4. Opened the browser's Inspect tool > Network tab, selected the 'Catalog', and copied all the cookies from the request headers.
      5. Opened Postman and populated the following fields:
         
         • Selected the 'GET' method and provided the 'Catalog' page URL.
         • In the Headers section, added a key-value pair:
           
           • Key:Cookie
           • Value: Pasted all the cookie values copied in Step 4.
      6. Clicked the Send button, then navigated to the Preview tab.
         
         • The 'Catalog' page became accessible, after using the cookies of the logged-in user.

      Observed Behavior: The 'Catalog' page was accessible in Postman after using the cookies of the logged-in user.

      Expected Behavior: The 'Catalog' page should not be accessible in Postman after using the cookies of the logged-in user, considering the restricted permissions for the guest user.

Environment

• Liferay DXP 7.4
• Quarterly Release
• Commerce

Resolution

This behavior is not considered a vulnerability but rather aligns with how HTTP is designed to function. For instance, when you copy the cookie of an authenticated user to make a request, these cookies identify the user and maintain session information. The same behavior can be observed on platforms like Amazon or other major websites.

• Session Prediction Concern: 
  
  • Predicting cookies is highly unlikely because they are not generated using user or deterministic information.
  • Session prediction is almost impossible due to the large and random nature of JSESSIONID. It would require significant computational power to predict such values.
    • For example, as outlined in the article, if a session ID is predictable (e.g., JSESSIONID = user01), an attacker might manipulate it to gain access by trying new values (e.g., user02). However, Liferay's security mechanisms prevent such scenarios by generating long, random session IDs.
• Liferay's Security Mechanisms:
  
  • Liferay’s JSESSIONID is designed with randomness and changes whenever a user logs in, invalidating previous sessions as a precaution.
  • These mechanisms ensure that predicting or reusing session IDs is highly improbable, offering robust protection against session-based attacks.