1374
Applicable Platforms
Technology : Web Based (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Always set the secure attribute when the cookie should sent via HTTPS only.
Demonstrative Examples
Example 1:
The snippet of code below, taken from a servlet doPost() method, sets an accountID cookie
(sensitive) without calling setSecure(true).
Example Language: Java (Bad)
Cookie c = new Cookie(ACCOUNT_ID, acctID);
response.addCookie(c);
Observed Examples
Reference Description
CVE-2004-0462 A product does not set the Secure attribute for sensitive cookies in HTTPS
sessions, which could cause the user agent to send those cookies in plaintext
over an HTTP session with the product.
https://www.cve.org/CVERecord?id=CVE-2004-0462
CVE-2008-3663 A product does not set the secure flag for the session cookie in an https
session, which can cause the cookie to be sent in http requests and make it
easier for remote attackers to capture this cookie.
https://www.cve.org/CVERecord?id=CVE-2008-3663
CVE-2008-3662 A product does not set the secure flag for the session cookie in an https
session, which can cause the cookie to be sent in http requests and make it
easier for remote attackers to capture this cookie.
https://www.cve.org/CVERecord?id=CVE-2008-3662
CVE-2008-0128 A product does not set the secure flag for a cookie in an https session, which
can cause the cookie to be sent in http requests and make it easier for remote
attackers to capture this cookie.
https://www.cve.org/CVERecord?id=CVE-2008-0128
MemberOf Relationships
CWE Version 4.14
CWE-615: Inclusion of Sensitive Information in Source Code Comments
CWE-615: Inclusion of Sensitive Information in Source Code Comments