Netcraft, which provides a range of services in the areas of Internet publishing and security, warns of a vulnerability in designed e-commerce Web sites with JavaServer Pages (JSPs). The problem involves session IDs and a possible exposure of private data.

The company originally reported the problem in late 2000, but in a recent survey of Internet sites, it noticed that many companies have not acted on the warning.

Netcraft recently reviewed a number of transactional sites, and many (more than a thousand, according to Netcraft) had not addressed the known problem with JSPs. A lot of these sites provide core banking, retail, ticketing, and e-commerce services, and handle large sums of money, says Netcraft.

Here's the problem. There's a vulnerability in the session IDs generated by various Java application servers based on the Java Servlet Development Kit (JSDK 2.0) -- such as Java Web Server (1.1+), IBM WebSphere, and ATG Dynamo e-Business Platform. With these systems, a user connecting to the site is issued a unique session ID that identifies subsequent requests made by that user, either encoded in the URLs or as a cookie. The server can then store data for each user session. Session IDs can also control access to sites that require a login: Instead of the user sending a name and password for every request, the site issues a session ID after the user logs on, which identifies the user for the rest of the session.

The danger is a person can hijack another user's session and perform transactions as if he were that person by guessing his session ID. If he's successful, the hacker can view any page, take any action, and post to any form the real user could.

Netcraft says a number of transactional sites, including some high-profile ones, are still using predictable session IDs. If you're still using them, the company advises you to read the original November 2000 report on the Netcraft Web site.

In that advisory, the company recommends you include random input in your session IDs if you're going to use them as the sole means of session tracking and management. In addition, any meaningful data being used in session IDs should be one-way encrypted.