Sensitive Cookie Without 'HttpOnly' Flag

Opis

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

Skutki

• Confidentiality

  Read Application Data

  If the HttpOnly flag is not set, then sensitive information stored in the cookie may be exposed to unintended parties.

• Integrity

  Gain Privileges or Assume Identity

  If the cookie in question is an authentication cookie, then not setting the HttpOnly flag may allow an adversary to steal authentication data (e.g., a session ID) and assume the identity of the user.

Zapobieganie

• Implementation

  Leverage the HttpOnly flag when setting a sensitive cookie in a response.

  Skuteczność: High

Przykłady podatności

• CVE-2024-47833 python library for ML and data science does not use the HTTPOnly security attribute for session cookies
• CVE-2022-24045 Web application for a room automation system has client-side Javascript that sets a sensitive cookie without the HTTPOnly security attribute, allowing the cookie to be accessed.
• CVE-2014-3852 CMS written in Python does not include the HTTPOnly flag in a Set-Cookie header, allowing remote attackers to obtain potentially sensitive information via script access to this cookie.
• CVE-2015-4138 Appliance for managing encrypted communications does not use HttpOnly flag.

Słabość nadrzędna

• CWE-732 Incorrect Permission Assignment for Critical Resource

Kiedy powstaje

• Implementation

Dotyczy

Not Language-Specific, Web Based, Web Server

Źródła

1. HttpOnly — OWASP
2. Some Bad News and Some Good News — Michael Howard, 2002
3. C is for cookie, H is for hacker - understanding HTTP only and Secure cookies — Troy Hunt, 2013
4. Mitigating Cross-site Scripting With HTTP-only Cookies — Microsoft
5. Securing Cookies: Why You Should Always Set HttpOnly — Ajay Monga, 2025