Description

Detects potential session fixation vulnerabilities in ASP.NET Core applications where session cookies are set directly through Response.Cookies.Append. This could allow attackers to force users into using known session identifiers, potentially hijacking their sessions.

Detection Strategy

• Check if the application uses Microsoft.AspNetCore.Mvc or Microsoft.AspNetCore.* libraries

• Look for direct calls to Response.Cookies.Append method in the code

• Verify if the cookie being set contains or manipulates session identifiers

• Report a vulnerability when session identifiers are directly set in response cookies without proper safeguards

Vulnerable code example

using Microsoft.AspNetCore.Mvc;

public class UnsafeController : Controller
{
    [HttpGet]
    public IActionResult ManageCookie(string userCookie)
    {
        // Vulnerable: Directly using user-provided input to set session cookie...

✅ Secure code example

using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Http;
using System.Text.RegularExpressions;
using System;

public class SafeController : Controller
{
    private void ValidateCookie(string value)...