Description

Detects session trust boundary violations in Rust applications using the actix_session library. This vulnerability occurs when sensitive or privileged data is stored in user-controlled session storage without proper validation, potentially allowing attackers to manipulate session data to escalate privileges or access unauthorized information.

Detection Strategy

• Check if the Rust code imports the actix_session library or any modules with the actix_session prefix

• Scan all method calls and expressions in the codebase that have been pre-selected as potential session-related operations

• Identify session write operations that store data in a way that violates trust boundaries by allowing user-controlled input to influence privileged session state

• Report a vulnerability when vulnerable session write patterns are detected in code that uses actix_session

Vulnerable code example

use actix_session::Session;
use actix_web::{get, web, HttpResponse};
use std::collections::HashMap;

#[get("/login")]
async fn login_vulnerable(
    session: Session,
    query: web::Query<HashMap<String, String>>,...

✅ Secure code example

use actix_session::Session;
use actix_web::{get, web, HttpResponse};
use std::collections::HashMap;
use uuid::Uuid;

#[get("/login")]
async fn login_secure(
    session: Session,...