It appears that the NetDynamics session management package does not properly manage its user state table. The previously generated session ID to that of a legitimate logged in user remains valid for that account for upwards of 15 seconds after login.
Therefore, it is possible for an attacker with understanding of the web application's command mappings to hijack random user sessions.
Vulnerable systems:
NetDynamics version 4.x
NetDynamics version 5.x
This attack can be carried out in the following manner:
An attacker visits the web application's login page where ndcgi.exe generates a 'random' session ID to sample the hidden 'SPIDERSESSION' tag as well as the 'uniqueValue' tag out of the html source.
The attacker must then wait for a legitimate user to login.
Append both variables to the end of a command request (URL will be wrapped):
