1283
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1012 Cross Cutting 2427
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Web Based (Prevalence = Often)
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Gain Privileges or Assume Identity
It is dangerous to use cookies to set a user's privileges.
The cookie can be manipulated to claim a high level of
CWE Version 4.14
CWE-784: Reliance on Cookies without Validation and Integrity Checking in a Security Decision
CWE-784: Reliance on Cookies without Validation
and Integrity Checking in a Security Decision 1654
Scope Impact Likelihood
authorization, or to claim that successful authentication has
occurred.
Potential Mitigations
Phase: Architecture and Design
Avoid using cookie data for a security-related decision.
Phase: Implementation
Perform thorough input validation (i.e.: server side validation) on the cookie data if you're going to
use it for a security related decision.
Phase: Architecture and Design
Add integrity checks to detect tampering.
Phase: Architecture and Design
Protect critical cookies from replay attacks, since cross-site scripting or other attacks may
allow attackers to steal a strongly-encrypted cookie that also passes integrity checks. This
mitigation applies to cookies that should only be valid during a single transaction or session. By
enforcing timeouts, you may limit the scope of an attack. As part of your integrity check, use an
unpredictable, server-side value that is not exposed to the client.
Demonstrative Examples
Example 1:
The following code excerpt reads a value from a browser cookie to determine the role of the user.
Example Language: Java (Bad)
Cookie[] cookies = request.getCookies();
for (int i =0; i< cookies.length; i++) {
Cookie c = cookies[i];
if (c.getName().equals("role")) {
userRole = c.getValue();
}
}
Example 2:
The following code could be for a medical records application. It performs authentication by
checking if a cookie has been set.
Example Language: PHP (Bad)
$auth = $_COOKIES['authenticated'];
if (! $auth) {
if (AuthenticateUser($_POST['user'], $_POST['password']) == "success") {
// save the cookie to send out in future responses
setcookie("authenticated", "1", time()+60*60*2);
}
else {
ShowLoginScreen();
die("\n");
}
}
DisplayMedicalHistory($_POST['patient_ID']);
The programmer expects that the AuthenticateUser() check will always be applied, and the
"authenticated" cookie will only be set when authentication succeeds. The programmer even
diligently specifies a 2-hour expiration for the cookie.
CWE Version 4.14
CWE-784: Reliance on Cookies without Validation and Integrity Checking in a Security Decision
CWE-784: Reliance on Cookies without Validation
and Integrity Checking in a Security Decision