CWE-1463 상세 정보

The product establishes an authenticated user session, but it does not properly set a timeout for the session. That is, the timeout is set to an excessively large value or is not set at all.

취약점 도입 방식

Implementation

적용 가능한 플랫폼

언어

클래스: Not Language-Specific (Undetermined)

운영 체제

클래스: Not OS-Specific (Undetermined)

아키텍처

클래스: Not Architecture-Specific (Undetermined)

기술

클래스: Client Server (Undetermined)
클래스: Web Based (Undetermined)

일반적인 결과

관찰된 예시

잠재적 완화 방법

Phases : Implementation
Ensure that user sessions have appropriate absolute timeouts set. The industry standard is between 4 and 8 hours for an absolute timeout [REF-1540].
Phases : Implementation
Ensure that user sessions have appropriate inactivity timeouts set. 2 to 5 minutes is recommended for high-value applications, and 15-30 minutes for low-risk applications [REF-1540].
Phases : Implementation
If using an authentication token for a user session, ensure that the token lifetime is configured based on the recommended best practices from the token provider [REF-1563]. There are situations using authentication tokens such as a JWT (Java Web Token) in which the server-side does not handle session timeouts and trusts the values directly from the token. In this case, it is important that the timeout value is set correctly for the token that is granted.

취약점 매핑 메모

근거 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
댓글 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction. Do not map to this CWE in situations where the timeout value is set, but the session is incorrectly invalidated; use CWE-1464 instead.

메모

This entry was created in CWE 5.0 to address known gaps in CWE coverage. It is not as complete as other new entries that were published in recent years. The CWE Team plans to work with the CWE community to make this entry more complete in later 5.x releases.

참고 자료

REF-1520

Insufficient Session Expiration
WASC.
http://projects.webappsec.org/w/page/13246944/Insufficient%20Session%20Expiration

REF-1540

Session Management Cheat Sheet
OWASP.
https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html

REF-1561

OWASP Web Security Testing Guide: 4.6 Session Management Testing
OWASP.
https://wstg.owasp.org/v4.2/4-Web_Application_Security_Testing/06-Session_Management_Testing/

REF-1562

Session Timeout
OWASP.
https://community.owasp.org/Session_Timeout

REF-1563

Access Token Lifetime
OAUTH.
https://www.oauth.com/oauth2-servers/access-tokens/access-token-lifetime/

REF-1564

Antipattern: Set a long expiration time for OAuth tokens
Google.
https://docs.cloud.google.com/apigee/docs/api-platform/antipatterns/oauth-long-expiration

제출