ASP.Net Unsafe Cookies Configuration

ID

csharp.unsafe_cookies_configuration

Severity

high

Resource

Misconfiguration

Language

CSharp

Tags

CWE:1004, CWE:315, CWE:539, CWE:614, NIST.SP.800-53, OWASP:2021:A7, PCI-DSS:6.5.10

Description

Improper configuration of cookies in an ASP.NET application can leave them vulnerable to attacks like XSS (Cross-Site Scripting) and MITM (Man-In-The-Middle).

Rationale

Cookies are a core part of maintaining session state in web applications. However, misconfigured cookies can be exploited to carry out various attacks.

Common issues include setting the httpOnly attribute to false, which makes cookies accessible through JavaScript, thus vulnerable to XSS attacks, or setting the requireSSL attribute to false, which makes cookies susceptible to interception in transit when not properly encrypted.

An example of unsafe configuration in ASP.NET:

<httpCookies httpOnlyCookies="false" requireSSL="false" />

In this example, the httpOnlyCookies attribute set to false allows client-side scripts to access cookies, making them vulnerable to client-side attacks. Similarly, requireSSL set to false allows cookies to be transmitted over unencrypted connections, increasing their risk of interception and theft.

Remediation

To secure cookie handling in your ASP.NET applications, you should set the httpOnlyCookies and requireSSL attributes to true. This prevents client-side scripts from accessing cookies and ensures that cookies are only sent over secure HTTPS connections.

<httpCookies httpOnlyCookies="true" requireSSL="true" />

Additionally, make a habit of demonstrating security-conscious behavior by reviewing cookie configurations regularly, especially when deploying onto production to prevent attackers from exploiting these vulnerabilities.

Configuration

The detector has the following configurable parameters:

  • checkPersistence, that indicates if the persistence of the cookie must be checked.

  • invalidCookieNamePattern, that indicates the pattern used to detect invalid cookie names.

  • invalidDomainPattern, that indicates the pattern used to detect invalid domain names.

  • invalidPathPattern, that indicates the pattern used to detect invalid paths.

  • enforceHttpOnly, that indicates if the HttpOnly flag of the cookie must be checked.

  • enforceSecure, that indicates if the Secure flag of the cookie must be checked.

References

  • CWE-315 : Cleartext Storage of Sensitive Information in a Cookie.

  • CWE-539 : Use of Persistent Cookies Containing Sensitive Information.

  • CWE-614 : Sensitive Cookie in HTTPS Session without 'Secure' Attribute.

  • CWE-1004 : Sensitive Cookie without 'HttpOnly' Flag.

  • OWASP - Top 10 2021 Category A05 : Security Misconfiguration.