Logout Not Invalidating Session

Question

One of our applications was recently scanned by Security and they were able to do a 'Session Replay Attack' in our application. The cookie does not appear to be expiring upon logout which allows a user to log back in under that session even after closing everything out. Our current Authentication Scheme is set to the following on logout:
wwv_flow_custom_auth_std.logout?p_this_flow=&APP_ID.&p_next_flow_page_sess=&APP_ID.:1000:&SESSION.
We are currently using APEX 2.2, can you provide any guidance as to how to expire the session cookie so no one can get in again?
Thank you,
Amy

Answer 1

Sorry for the delay in responding, I had to get the information from the security person that was able to do this. Here are the responses below:
I need more details of what was done in this scenario. Are you saying that the logout procedure did not change the value of the cookie in the browser session? How did you determine that?
- The session cookie assigned when logging in the first time did not expire immediately when the person logged out. Without logging in, all I would need to do is resubmit the session cookie in my requests to gain access to the application. I accomplished this using a web proxy to capture requests between the browser and server allowing me to manipulate data sent to /from the server.
What was the value of the session cookie after the logout occurred?
- I merely reused the session cookie already provided. Cookie submitted was: WWV_CUSTOM-F_2695714197338609_1100=04ACEC38BA5368CD
Then by "after closing everything out" the user was able to enter username/password in the login page and run the application again in the original session, is that right?
- No username / password needed. Session cookie is used as my validation.
Does this have anything to do with the previous or new version of the session cookie?
- Reusing previous cookie. Replacing new cookie with old cookie. Hence, ‘session replay attack’.
In words, if you look at the value of the original session cookie before the logout and the cookie value after logout and the cookie value after the second login, are all three values (or at least the first and third values) the same?
- I am reusing / substituting an old cookie and replacing new ones with the old one.
Or are you making no statements about cookies at all but saying only that being able to use a session ID that was previously used (and logged out of) seems to be possible by the same named user in the same application.
- Cookies are used for Session ID. Anyone can reuse that cookie / session ID and masquerade as that user.
Thanks for the help and let me know if you need anymore information or clarifications.
Amy