OpenControls Logo

STIG Viewer

STIGViewer Support

Applications must use system-generated session identifiers that protect against session fixation.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-222579APSC-DV-002250SV-222579r1043180_ruleCCI-001664medium
Description
Session fixation allows an attacker to hijack a valid user’s application session. The attack focuses on the manner in which a web application manages the user’s session ID. Applications become vulnerable when they do not assign a new session ID when authenticating users thereby using the existing session ID. Many web development frameworks such as PHP, .NET, and ASP include their own mechanisms for session management. Whenever possible it is recommended to utilize the provided session management framework. In many cases, creating a new session ID cookie containing a new unique value whenever authentication is performed will address the issue of session fixation. Allowing the user to submit a session ID also introduces the risk that the application could be subject to a session fixation attack.
STIGDate
Application Security and Development Security Technical Implementation Guide2025-09-09

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-09.2Unique System-Generated Session Identifiers
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (12) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AU-4(1)Transfer to Alternate Storage
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
SC-2Separation of System and User Functionality
1.00
SC-23(3)Unique System-generated Session Identifiers
1.00
SC-5Denial-of-service Protection
1.00
SC-8Transmission Confidentiality and Integrity
1.00
SC-8(2)Pre- and Post-transmission Handling
1.00

+2 more (top 10 by confidence shown)

CCI1 mapping
CCI-001664
1.00

Details

Check Text (C-222579r1043180_chk)

Review the application documentation and interview the application administrator to identify how the application generates user session IDs. Application session testing is required in order to verify this requirement. Request the latest application vulnerability or penetration test results. Verify the test configuration includes session handling vulnerability tests. If the application is re-using/copying the users existing session ID that was created on one system in order to maintain user state when traversing multiple application servers in the same domain, this is not a finding. If the session testing results indicate application session IDs are re-used after the user has logged out, this is a finding.

Fix Text (F-24238r493646_fix)

Design the application to generate new session IDs with unique values when authenticating user sessions.