Detections
Analytics

ASP.NET Cookieless Session State Enabled

low Web App Scanning Plugin ID 114610

Language:

Synopsis

ASP.NET Cookieless Session State Enabled

Description

.NET Framework offers an alternative to cookie based session management named 'cookieless' by allowing developers to store the session ID directly in URLs rather than in cookies. When enabled, this feature can be abused to make session hijacking attacks easier to exploit or to craft valid URLs in order to bypass security mechanisms such as Web Application Firewalls (WAFs) or path based restrictions.

Solution

Ensure that .NET Cookieless feature is disabled by forcing the value of the 'cookieless' attribute of the <sessionState> configuration to 'UseCookies'.

See Also

https://learn.microsoft.com/en-us/previous-versions/dotnet/articles/aa479314(v=msdn.10)

https://www.sans.org/blog/session-attacks-and-asp-net-part-2/

Plugin Details

Severity: Low

ID: 114610

Type: remote

Published: 3/3/2025

Updated: 3/3/2025

Scan Template: basic, full, pci, scan

Risk Information

VPR

Risk Factor: Low

Score: 2.5

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: Tenable

CVSS v3

Risk Factor: Medium

Base Score: 4.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

CVSS Score Source: Tenable

CVSS v4

Risk Factor: Low

Base Score: 2.1

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: Tenable

Reference Information