{"action":"created","issue":{"url":"https://api.github.com/repos/yiisoft/yii2/issues/8537","labels_url":"https://api.github.com/repos/yiisoft/yii2/issues/8537/labels{/name}","comments_url":"https://api.github.com/repos/yiisoft/yii2/issues/8537/comments","events_url":"https://api.github.com/repos/yiisoft/yii2/issues/8537/events","html_url":"https://github.com/yiisoft/yii2/issues/8537","id":80208860,"number":8537,"title":"Cookie Reuse attack vulnerability","user":{"login":"ali-alamine","id":8051575,"avatar_url":"https://avatars.githubusercontent.com/u/8051575?v=3","gravatar_id":"","url":"https://api.github.com/users/ali-alamine","html_url":"https://github.com/ali-alamine","followers_url":"https://api.github.com/users/ali-alamine/followers","following_url":"https://api.github.com/users/ali-alamine/following{/other_user}","gists_url":"https://api.github.com/users/ali-alamine/gists{/gist_id}","starred_url":"https://api.github.com/users/ali-alamine/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ali-alamine/subscriptions","organizations_url":"https://api.github.com/users/ali-alamine/orgs","repos_url":"https://api.github.com/users/ali-alamine/repos","events_url":"https://api.github.com/users/ali-alamine/events{/privacy}","received_events_url":"https://api.github.com/users/ali-alamine/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/yiisoft/yii2/labels/status:to%20be%20verified","name":"status:to be verified","color":"fbca04"},{"url":"https://api.github.com/repos/yiisoft/yii2/labels/type:bug","name":"type:bug","color":"e102d8"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-05-24T16:51:51Z","updated_at":"2015-05-24T19:12:33Z","closed_at":null,"body":"Hello,\r\nApparently yii2's session manager is vulnerable to Cookie Reuse attacks (type of session hijacking).\r\n\r\nSteps to repeat:\r\n- Login as a user  \r\n- Copy the content of all cookies (can be done easily with the 'edit this cookie' chrome extension, export cookies)\r\n- Logout\r\n- Import the previously exported cookies\r\n- Refresh the page -- Now you are logged in without password.\r\n\r\nI tried this with pasting the cookies on a different computer in the same network and it worked (didn't try for another ip though)\r\n\r\nDesired effect: When I logout the cookies saved should not work\r\n\r\nNote: I only tried this with the default PHP session manager. Didn't try the db or cache ones."},"comment":{"url":"https://api.github.com/repos/yiisoft/yii2/issues/comments/105050884","html_url":"https://github.com/yiisoft/yii2/issues/8537#issuecomment-105050884","issue_url":"https://api.github.com/repos/yiisoft/yii2/issues/8537","id":105050884,"user":{"login":"ali-alamine","id":8051575,"avatar_url":"https://avatars.githubusercontent.com/u/8051575?v=3","gravatar_id":"","url":"https://api.github.com/users/ali-alamine","html_url":"https://github.com/ali-alamine","followers_url":"https://api.github.com/users/ali-alamine/followers","following_url":"https://api.github.com/users/ali-alamine/following{/other_user}","gists_url":"https://api.github.com/users/ali-alamine/gists{/gist_id}","starred_url":"https://api.github.com/users/ali-alamine/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ali-alamine/subscriptions","organizations_url":"https://api.github.com/users/ali-alamine/orgs","repos_url":"https://api.github.com/users/ali-alamine/repos","events_url":"https://api.github.com/users/ali-alamine/events{/privacy}","received_events_url":"https://api.github.com/users/ali-alamine/received_events","type":"User","site_admin":false},"created_at":"2015-05-24T19:12:33Z","updated_at":"2015-05-24T19:12:33Z","body":"1) Sorry just checked again, I was indeed using the remember me.\r\n2) I'm using the advanced installation (didn't check the basic). And just did a clean install and it works.\r\n\r\nAs for the remember me, even if I'm using it, the cookies should be unvalid when I logout."}}