The IIS 8.5 web server Session State cookie settings must be configured to regenerate expired session IDs.

From IIS 8.5 Server Security Technical Implementation Guide

Associated with: CCI-001185

SV-91419r2_rule The IIS 8.5 web server Session State cookie settings must be configured to regenerate expired session IDs.

Vulnerability discussion

Captured sessions can be reused in "replay" attacks. This requirement limits the ability of adversaries from capturing and continuing to employ previously valid session IDs.Session IDs are tokens generated by web applications to uniquely identify an application user's session. Unique session IDs help to reduce predictability of said identifiers. When a user logs out, or when any other session termination event occurs, the web server must terminate the user session to minimize the potential for an attacker to hijack that particular user session.Cookies associate session information with client information for the duration of a user’s connection to a website. Using cookies is a more efficient way to track session state than any of the methods that do not use cookies because cookies do not require any redirection.

Check content

Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Select "Configuration Editor" under the "Management" section. From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState". Verify "cookieless" is set to "UseCookies". Verify the "regenerateExpiredSessionID" is set to "True". If "cookieless" is not set to "UseCookies" and/or the "regenerateExpiredSessionID" is not set to "true", this is a finding.

Fix text

Open the IIS 8.5 Manager. Click the IIS 8.5 web server name. Select "Configuration Editor" under the "Management" section. From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState". Set "cookieless" to "UseCookies". Set "regenerateExpiredSessionID" to "True". Click "Apply" under the "Actions" pane.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.