Description

Detects misconfigured Spring Security session fixation protection in Scala applications. Session fixation vulnerabilities occur when the application fails to generate a new session ID upon user authentication, allowing attackers to potentially hijack authenticated sessions using pre-set session identifiers.

Detection Strategy

• Code imports Spring Security's HttpSecurity configuration classes

• The Spring Security configuration includes 'sessionFixation' settings

• The sessionFixation protection is disabled or set to 'none' either through direct session management configuration or lambda expressions

• The configuration does not implement alternative session fixation protections

Vulnerable code example

import org.springframework.context.annotation.Bean
import org.springframework.context.annotation.Configuration
import org.springframework.security.config.annotation.web.builders.HttpSecurity
import org.springframework.security.web.SecurityFilterChain

@Configuration
class VulnerableSecurityConfig {
    @Bean...

✅ Secure code example

import org.springframework.context.annotation.Bean
import org.springframework.context.annotation.Configuration
import org.springframework.security.config.annotation.web.builders.HttpSecurity
import org.springframework.security.web.SecurityFilterChain

@Configuration
class SecureSecurityConfig {
    @Bean...