CVE-2020-10714: 
Java vulnerability analysis and mitigation

A session fixation vulnerability was discovered in WildFly Elytron version 1.11.3.Final and earlier. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The vulnerability was assigned CVE-2020-10714 and was discovered by Mark Banierink from Nedap (Red Hat Bugzilla).

The vulnerability exists in WildFly Elytron's FORM authentication mechanism when a session ID is present in the URL. The server by default supports session tracking by both URL and Cookie methods. The session fixation attack is a class of Session Hijacking, but instead of stealing an established session after login, it fixes a session on the victim's browser before the user logs in. The vulnerability received a CVSS v3.1 base score of 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD, NetApp Advisory).

Successful exploitation of this vulnerability could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS). The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability (NVD).

The attack is dependent on the attacker being able to create a session and the victim accessing the session before it expires. By default, there is a 15-minute session timeout, though attackers could keep the session alive by sending requests every five minutes. The SPNEGO authentication mechanism is also affected, though it tends to be used on internal networks rather than the internet, which could be a mitigating factor (Red Hat Bugzilla).

The vulnerability can be mitigated by updating the web.xml configuration to support COOKIE-only session tracking instead of URL-based tracking. The exploit is not possible when sharing links if cookie-only mode is enabled. Additionally, the vulnerability has been fixed in WildFly Elytron version 1.10.7.Final and later releases (Red Hat Bugzilla).