CVE-2018-16958 : Security Advisory and Response
Discover the security vulnerability in Oracle WebCenter Interaction Portal 10.3.3 with the absence of the HttpOnly attribute in the ASP.NET_SessionID cookie, potentially leading to session hijacking attacks. Learn how to mitigate and prevent this issue.
A vulnerability has been identified in Oracle WebCenter Interaction Portal 10.3.3 where the main session cookie, ASP.NET_SessionID, lacks the HttpOnly attribute, making it susceptible to session hijacking attacks.
Understanding CVE-2018-16958
This CVE highlights a security issue in Oracle WebCenter Interaction Portal 10.3.3 related to session cookie security.
What is CVE-2018-16958?
The vulnerability in Oracle WebCenter Interaction Portal 10.3.3 allows attackers to potentially hijack sessions due to the absence of the HttpOnly attribute in the ASP.NET_SessionID cookie.
The Impact of CVE-2018-16958
The vulnerability exposes users to session hijacking attacks if an attacker can execute JavaScript within the portal installation origin.
Technical Details of CVE-2018-16958
This section delves into the technical aspects of the CVE.
Vulnerability Description
The primary session cookie, ASP.NET_SessionID, in Oracle WebCenter Interaction Portal 10.3.3 is not safeguarded with the HttpOnly attribute, leaving it vulnerable to session hijacking.
Affected Systems and Versions
- Product: Oracle WebCenter Interaction Portal 10.3.3
- Vendor: Oracle
- Versions: Not specified
Exploitation Mechanism
The vulnerability arises when using Internet Information Services (IIS) with ASP.NET, where customers are unable to enable the HttpOnly attribute, making the cookie susceptible to exploitation.
Mitigation and Prevention
Protecting systems from CVE-2018-16958 is crucial to maintaining security.
Immediate Steps to Take
- Monitor for any unusual activities related to session handling.
- Implement additional security measures to mitigate session hijacking risks.
Long-Term Security Practices
- Regularly update and patch the system to address security vulnerabilities.
- Conduct security audits to identify and rectify any potential weaknesses.
Patching and Updates
- Stay informed about security advisories and updates from Oracle.
- Apply patches or workarounds provided by Oracle to secure the system.