Apache Shiro: Session fixation: new session is not created after login by default

Vulnerability

Apache Shiro versions 1.0 through 2.1.0 and 3.0.0-alpha-1 have a session fixation vulnerability in their default configurations [1]. When a user logs in, the existing session is not invalidated and a new session ID is not generated, allowing an attacker to pre-set a session ID and have the victim authenticate with that session [1].

Exploitation

An attacker can craft a link containing a known session ID and trick a victim into clicking it, establishing a session on the Shiro application. When the victim logs in, the session ID remains the same, giving the attacker knowledge of the authenticated session ID [1]. No special network position or authentication is required beyond social engineering to deliver the session ID.

Impact

Successful exploitation allows an attacker to hijack the victim's authenticated session after login, gaining access to the victim's account and any associated data or actions [1]. This compromises confidentiality and integrity of user sessions.

Mitigation

Upgrade to Apache Shiro version 2.1.1, 2.2.0, 3.0.0-alpha-2, or later [1]. These versions invalidate the existing session and create a new session with a new ID upon successful login [1]. No workaround is provided for unpatched versions.