KB486737: MSTR_AUTH Cookie Functions as a Secondary Token to Combat Session Fixation and Hijacking

Symptom

In Strategy Web ASP, it is observed that the application accepts a pre-defined "ASP.NET_SessionId" and does not issue a new one upon a new user session login.

Steps to Reproduce

• IIS

• Launch a new incognito browser window and open the Chrome developer tool. Select the 'Application' tab to view the cookies section. Access Strategy Web (e.g.,http://localhost/Strategy/asp/Main.aspx) and observe that there is a single record titled 'bSet' with a random value.
  

• Manually add a new "ASP.NET_SessionId" with a unique 24-character string, such as 'AAAAAAAAAAAAAAAAAAAAAAAA'.
  

• Proceed to log into the web application. Post-login, the "ASP.NET_SessionId" remains unchanged, but the "MSTR_AUTH" cookie is generated.
  

• Upon logging out and logging back in, a new "ASP.NET_SessionId" is created, and the "MSTR_AUTH" cookie is updated to reflect this change.
  

• Tomcat

• Proceed to https://xxx:8443/MicroStrategy/servlet/mstrWeb and once the page is loaded, use the developer tools within the web browser and navigate to "Cookies" in the Application tab.
  

• Change the "JSESSIONID" value to any arbitrary 24 characters long string 'AAAAAAAAAAAAAAAAAAAAAAAA'
  

• Log in as per normal into the web application and observe that once the user is logged in, the "JSESSIONID" value has been refreshed, the "MSTR_AUTH" cookie also generated.
  

Cause

The MSTR_AUTH cookie is a secondary token which mitigates session fixation and hijacking. 
 

Solution

Users should have both valid JSESSIONID/ASP.Net_SessionId and MSTR_AUTH in order to access Strategy Web successfully.