2112
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Set the SameSite attribute of a sensitive cookie to 'Lax' or 'Strict'. This instructs the browser
to apply this cookie only to same-domain requests, which provides a good Defense in Depth
against CSRF attacks. When the 'Lax' value is in use, cookies are also sent for top-level crossdomain
navigation via HTTP GET, HEAD, OPTIONS, and TRACE methods, but not for other
HTTP methods that are more like to cause side-effects of state mutation.
Effectiveness = High
While this mitigation is effective for protecting cookies from a browser's own scripting engine,
third-party components or plugins may have their own engines that allow access to cookies.
Attackers might also be able to use XMLHTTPResponse to read the headers directly and obtain
the cookie.
Demonstrative Examples
Example 1:
In this example, a cookie is used to store a session ID for a client's interaction with a website. The
snippet of code below establishes a new cookie to hold the sessionID.
Example Language: JavaScript (Bad)
let sessionId = generateSessionId()
let cookieOptions = { domain: 'example.com' }
response.cookie('sessionid', sessionId, cookieOptions)
Since the sameSite attribute is not specified, the cookie will be sent to the website with each
request made by the client. An attacker can potentially perform a CSRF attack by using the
following malicious page:
Example Language: HTML (Attack)
<html>
<form id=evil action="http://local:3002/setEmail" method="POST">
<input type="hidden" name="newEmail" value="abc@example.com" />
</form>
<script>evil.submit()</script>
</html>
When the client visits this malicious web page, it submits a '/setEmail' POST HTTP request to the
vulnerable website. Since the browser automatically appends the 'sessionid' cookie to the request,
the website automatically performs a 'setEmail' action on behalf of the client.
To mitigate the risk, use the sameSite attribute of the 'sessionid' cookie set to 'Strict'.
Example Language: JavaScript (Good)
let sessionId = generateSessionId()
let cookieOptions = { domain: 'example.com', sameSite: 'Strict' }
response.cookie('sessionid', sessionId, cookieOptions)
Observed Examples
CWE Version 4.14
CWE-1276: Hardware Child Block Incorrectly Connected to Parent System
CWE-1276: Hardware Child Block Incorrectly Connected to Parent System