RIPE NCC session fixation: poaching logins with an Atlas probe
Summary
The article details RIPE NCC session fixation where SSO tokens were not rotated on login, enabling attackers to plant a token and hijack sessions. It describes two attack variants, one via an XSS in RIPEstat and another via an Atlas probe, with potential access to key RIPE NCC services. The post also covers fixes, disclosure timeline, and recommendations to prevent third party infrastructure from sharing the SSO cookie domain.