Description

This detector identifies PHP session trust boundary violations where untrusted user input is directly stored in session variables without proper sanitization. This creates a security risk as malicious data can persist across requests and potentially be used in attacks like session poisoning or privilege escalation.

Detection Strategy

• The detector scans PHP code for assignments to $_SESSION variables

• It identifies cases where $_SESSION array keys contain suspicious or problematic naming patterns

• It traces the data flow of values being assigned to these session variables

• It checks if the assigned values originate from unsafe user input sources (like $_GET, $_POST, $_REQUEST)

• It verifies that no proper sanitization or validation is applied to the input before storage

• A vulnerability is reported when untrusted input flows directly into session storage without adequate security controls

Vulnerable code example

<?php

function authenticateUser() {
    $_SESSION['password'] = $_POST['password']; // Direct storage of sensitive input
    $_SESSION['role'] = $_GET['role']; // Unvalidated user input to session
}

✅ Secure code example

<?php

function authenticateUser() {
    // Hash password before storing in session
    if (isset($_POST['password'])) {
        $_SESSION['password'] = password_hash($_POST['password'], PASSWORD_BCRYPT);
    }
    ...