The CA API Gateway must invalidate session identifiers upon user logout or other session termination.

From CA API Gateway ALG Security Technical Implementation Guide

Part of SRG-NET-000231-ALG-000114

Associated with: CCI-001185

SV-85995r1_rule The CA API Gateway must invalidate session identifiers upon user logout or other session termination.

Vulnerability discussion

Captured sessions can be reused in "replay" attacks. This requirement limits the ability of adversaries from capturing and continuing to employ previously valid session IDs.Session IDs are tokens generated by web applications to uniquely identify an application user's session. Unique session identifiers or IDs are the opposite of sequentially generated session IDs, which can be easily guessed by an attacker. Unique session IDs help to reduce predictability of said identifiers. When a user logs out, or when any other session termination event occurs, the network element must terminate the user session to minimize the potential for an attacker to hijack that particular user session.ALGs act as an intermediary for applications; therefore, session control is part of the function provided. This requirement focuses on communications protection at the application session, rather than at the network packet level.The CA API Gateway must protect against replay attacks by using an out-of-the-box "Protect Against Message Replay" Assertion within the registered services that will assist with validating and invalidating sessions as per organizational requirements.

Check content

Open the CA API Gateway - Policy Manager and open each of the Registered Services that require the invalidation of session identifiers in order to protect against replay attacks. Verify the "Protect Against Message Replay" Assertion is present after the "Authenticate User or Group" or "Authenticate Against Identity Provider" Assertion. If the Assertion is not present, this is a finding.

Fix text

Open the CA API Gateway - Policy Manager and open each of the Registered Services that did not include the "Protect Against Message Replay" Assertion but that require the protection. Add the "Protect Against Message Replay" Assertion to the policies, configure the Assertion in accordance with organizational requirements, and click "Save and Activate".

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer