Plaintext Storage In Cookie

ID

javascript.plaintext_storage_in_cookie

Severity

low

Resource

Information Leak

Language

JavaScript

Tags

CWE:315, NIST.SP.800-53

Description

Cleartext storage of sensitive information in a cookie occurs when sensitive data is stored in cookies without any form of encryption, potentially exposing it to unauthorized access.

This vulnerability can lead to information disclosure and can be exploited by attackers who gain access to the cookies.

Rationale

This vulnerability arises when sensitive information such as usernames, session IDs, or authentication tokens are stored directly in cookie values without being encrypted. This practice poses a security risk because cookies can be intercepted over unsecured channels, or accessed by other scripts (e.g., cross-site scripting attacks).

The following example sets sensitive data into a cookie in clear text and without any protection against eventual leakage:

var express = require('express');

var app = express();
app.get('/new_patient', function (req, res) {
    // ...
    var patient_number = getPatientNumber(req);
    // Setting a cookie value with cleartext sensitive data.
    res.cookie("PatientNumber", patient_number); // FLAW
});

Remediation

If possible, do not store sensitive information in cookies. Having sensitive data stored in a cookie could be a sign of bad design. Instead of storing e.g. user details in a cookie, store them at the application backend and use session tokens to identify the user. Proper session handling is essential to prevent session fixation attacks.

If you really need to store sensitive information in a cookie, ensure that it is encrypted at the backend. Use safe encryption standards and cryptographic libraries to achieve this.

Ensure that the cookie is marked as secure, which prevents it from being sent over an insecure channel (e.g., HTTP), and with the httpOnly flag, which prevents it from being accessed by JavaScript in the browser, avoiding exfiltration by exploiting cross-site scripting vulnerabilities.

The fix could either encrypt / hash the data before adding it to the cookie, or alternatively use the secure and httpOnly flags so the cookie is protected from leakage.

var express = require('express');
var crypto = require('crypto'),
    key = getEncryptionKey(); // 32 bytes for AES-256

// Encrypt sensitive data
function encrypt(text) {
    const iv = crypto.randomBytes(16);
    const cipher = crypto.createCipheriv('aes-256-ctr', key, iv);
    return cipher.update(text, 'utf8', 'hex') + cipher.final('hex') + Buffer.from(iv).toString('hex');
}

var app = express();
app.get('/new_patient', function (req, res) {
    var patient_number = getPatientNumber(req);
    // FIXED - encrypt the sensitive information in the cookie
    res.cookie("PatientNumber", encrypt(patient_number));
    // Alternative fix - Use secure and httpOnly flags to protect the cookie (allowed by detector)
    res.cookie("PatientNumber", patient_number, {secure: true, httpOnly: true});
});

Configuration

The detector does not need any configuration.

References