search

endpointlabs / VulnerableDotNetCore3Project

.Net Core 3.0
0 stars 0 forks source link

Insufficient Cookie Protection (Missing ‘secure’) (CWE-614) #24

Open mgulter opened 2 years ago

mgulter commented 2 years ago

A low severity vulnerability has been discovered in your project.

Project Name: SeekerDiscrepancyTest

Scanner Name: seeker

Cwe ID: 614

Cwe Name: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Cwe Link: https://cwe.mitre.org/data/definitions/614.html

Code Location: io.undertow.servlet.spec.HttpServletResponseImpl.addCookie()

HTTP Headers: 

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Connection: keep-alive
Cookie: JSESSIONID=9Vw9upvTzwYtQBbExrepXZxm1p1h1yj4M3J6b_wI; JSESSIONID.6c57fffc=node01hmxezknsniqh15ucpcy4cxjf63.node0; jenkins-timestamper-offset=-7200000; JSESSIONID.2174ba4f=node01pjim8rb06v8o18jkxfdv2ypb64.node0; JSESSIONID.1f7398e7=node01sj1zkbol90rd2tt6my80rawi3.node0; JSESSIONID.b1924f30=node01t1jcdhky4r3r16sns7dnz0jle9.node0; JSESSIONID.0d07728e=node01ivdf4vg4d3jrm3jhi4co9w6b1.node0; XSRF-TOKEN=e63e8344-f47d-4345-b3ce-b5a89b253b36; JSESSIONID=EAA7A12540D96995ADC4005E3DE5E0E7; JSESSIONID.2ba500d2=node098cwfpbz72hu1dzjqsbhdza701.node0; screenResolution=1867x1167; language=en; welcomebanner_status=dismiss; cookieconsent_status=dismiss; ASP.NET_SessionId=8EE3BF15F81E5E87AD95B5E4
Host: localhost:8080
Referer: http://localhost:8080/WebGoat/start.mvc
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="100", "Google Chrome";v="100"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"

Summary: The application uses cookies in order to interact with the user browser. However, the secure cookie attribute that prevents the cookie from being sent over unencrypted communication channel is not set. As a result, an attacker can lure the user to send a request to the HTTP server rather than the HTTPS server, exposing the cookies to sniffing attacks (even when the application is not available through the HTTP port). Successful sniffing of the user cookies at this point allows the attacker to impersonate the user in the application. Following is the cookie used without the required attribute: JSESSIONID The URL that triggered the cookie set was: /WebGoat/logout Following is the source code which processes such requests: io.undertow.servlet.spec.HttpServletResponseImpl.addCookie() at io.undertow.servlet.spec.HttpServletResponseImpl.addCookie(HttpServletResponseImpl.java) at javax.servlet.http.HttpServletResponseWrapper.addCookie(HttpServletResponseWrapper.java:60) at org.springframework.security.web.firewall.FirewalledResponse.addCookie(FirewalledResponse.java:72) at javax.servlet.http.HttpServletResponseWrapper.addCookie(HttpServletResponseWrapper.java:60) at javax.servlet.http.HttpServletResponseWrapper.addCookie(HttpServletResponseWrapper.java:60) at org.springframework.security.web.authentication.logout.CookieClearingLogoutHandler.lambda$logout$2(CookieClearingLogoutHandler.java:74) at java.util.ArrayList.forEach(ArrayList.java:1511) at org.springframework.security.web.authentication.logout.CookieClearingLogoutHandler.logout(CookieClearingLogoutHandler.java:74) at org.springframework.security.web.authentication.logout.CompositeLogoutHandler.logout(CompositeLogoutHandler.java:54) at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:99) at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:89) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:90) at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:75) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:110) at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:80) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:55) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:211) at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:183) at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358) at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:93) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61) at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131) at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84) at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62) at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:68) at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36) at io.undertow.servlet.handlers.RedirectDirHandler.handleRequest(RedirectDirHandler.java:68) at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:117) at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46) at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64) at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60) at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77) at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.SendErrorPageHandler.handleRequest(SendErrorPageHandler.java:52) at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43) at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:269) at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:78) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:133) at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:130) at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48) at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43) at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:249) at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:78) at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:99) at io.undertow.server.Connectors.executeRootHandler(Connectors.java:387) at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:841) at org.jboss.threads.ContextClassLoaderSavingRunnable.run(ContextClassLoaderSavingRunnable.java:35) at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:2019) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1558) at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1449)

Remediation: It is recommended that the secure attribute be set for cookies to prevent accidental exposure of cookies. In addition, if not required as part of application functionality, it is recommended that the non-SSL port on the server be disabled.

Training(Secure Code Warrior):

Tool Description: The application uses cookies in a way that does not prevent them from being sent to unencrypted pages. As a result, if an attacker lures the user to access the web server via HTTP (even if the application is not available on this port) the user's cookies can be intercepted by an attacker monitoring the traffic to the application.

Custom Description: NEW ENDPOINT TEST