Hello Sir ,

I am a Certified Cyber Security Expert & Security Researcher at Google.Me (Parveen Yadav) and my friend Tejash Patel was doing some Pen-testing ,then I came across a Vulnerability on your website i.e :-
http://www.drupal.org
Your website is vulnerable to Cookies Fixation Vulnerability.

A quick overview of Cookies Fixaion Vulnerability :-
Web-based applications frequently use sessions or cookies to provide a friendly environment to their users.The basic idea behind web cookie management is that the server generates a cookie identifier (ID) at some early point when user logged in the website, Cookie is generate on the client side .

Cookie have his own advantages& disadvantages .
By using cookie a user can connect back on the website without logging in again.So,it is enviornmentaly friendly to user but it have his own consequences also i.e :- If any attacker comes on the client side and stole the cookies of client then attacker can also use his profile ,he can do severe damages to the profile of Client user I.d. Attacker can either intercepting, predicting or cookies issued by the web server to the user’s browser. Attacker thereby forcing the browser into using a chosen cookies.

Solution :- In order to overcome this problem, web servers – or sometimes web applications – implement various kinds of session/Cookies management.Cookies have to expire automatically when a user exit from the browser .

Kindly check the attachemnets for Proof of Concept,go to the below link of mediafire and download the video as we are unable to attach that video here beacuse of the size problem .
- http://www.mediafire.com/?d9r77nwfuwcdjd6

Hope the above information would be helpful to strengthen the website security.I would be happy to extend any support and help required to resolve the issue further.Thanks for your time and consideration.

Comments

killes@www.drop.org’s picture

killes@www.drop.org commented

If you were qualified for securtity related work, you'd have heard about responsible disclosure, wouldn't you?

Since this doesn't seem to be the case, here's a link for you: https://en.wikipedia.org/wiki/Responsible_disclosure

Essentially, the claim is that cookies wouldn't be invalidated on log-out.

I think that maybe the bakery SSO cookie is not invalidated and thus you got logged in again after importing it.

I'll unpublish this for the time being.

killes@www.drop.org’s picture

killes@www.drop.org commented

I've republished this after discussion with Heine.

The above is correct, the SSO cookie is not invalidated and creates a new valid session as long as it is valid itself. This is by design.

heine’s picture

heine commented
Priority: Critical » Normal

What constitutes the "fixation" here?

As Killes says, the SSO cookies is valid for 2 hours by design.

killes@www.drop.org’s picture

killes@www.drop.org commented
Status: Active » Postponed (maintainer needs more info)

postponing

dddave’s picture

dddave commented
Status: Postponed (maintainer needs more info) » Closed (won't fix)