이름: Sensitive Cookie Without 'HttpOnly' Flag

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

일반 정보

배경 세부 정보

취약점 도입 방식

Implementation

적용 가능한 플랫폼

언어

클래스: Not Language-Specific (Undetermined)

기술

클래스: Web Based (Undetermined)
이름: Web Server (Undetermined)

일반적인 결과

범위	영향	가능성
Confidentiality	Read Application Data 참고: If the HttpOnly flag is not set, then sensitive information stored in the cookie may be exposed to unintended parties.
Integrity	Gain Privileges or Assume Identity 참고: If the cookie in question is an authentication cookie, then not setting the HttpOnly flag may allow an adversary to steal authentication data (e.g., a session ID) and assume the identity of the user.

관찰된 예시

참고 자료	설명
CVE-2024-47833	python library for ML and data science does not use the Secure flag (CWE-614) or HTTPOnly security attribute (CWE-1004) for session cookies.
CVE-2022-24045	Web application for a room automation system has client-side Javascript that sets a sensitive cookie without the HTTPOnly security attribute, allowing the cookie to be accessed.
CVE-2014-3852	CMS written in Python does not include the HTTPOnly flag in a Set-Cookie header, allowing remote attackers to obtain potentially sensitive information via script access to this cookie.
CVE-2015-4138	Appliance for managing encrypted communications does not use HttpOnly flag.

잠재적 완화 방법

Phases : Implementation
Leverage the HttpOnly flag when setting a sensitive cookie in a response.

탐지 방법

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
효과성 : High

취약점 매핑 메모

근거 : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
댓글 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

참고 자료

REF-2

HttpOnly
OWASP.
https://owasp.org/www-community/HttpOnly

REF-3

Some Bad News and Some Good News
Michael Howard.
https://learn.microsoft.com/en-us/previous-versions/ms972826(v=msdn.10)?redirectedfrom=MSDN

REF-4

C is for cookie, H is for hacker - understanding HTTP only and Secure cookies
Troy Hunt.
https://www.troyhunt.com/c-is-for-cookie-h-is-for-hacker/

REF-5

Mitigating Cross-site Scripting With HTTP-only Cookies
Microsoft.
https://learn.microsoft.com/en-us/previous-versions//ms533046(v=vs.85)?redirectedfrom=MSDN

REF-1490

Securing Cookies: Why You Should Always Set HttpOnly
Ajay Monga.
https://medium.com/@ajay.monga73/securing-cookies-why-you-should-always-set-httponly-92489cbf76c1

제출

이름	조직	날짜	출시일	Version
CWE Content Team	MITRE	2017-01-02 +00:00	2017-01-19 +00:00	2.10

수정 사항

이름	조직	날짜	댓글
CWE Content Team	MITRE	2017-11-08 +00:00	updated Applicable_Platforms, References, Relationships
CWE Content Team	MITRE	2020-02-24 +00:00	updated Applicable_Platforms, Relationships
CWE Content Team	MITRE	2021-10-28 +00:00	updated Relationships
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Detection_Factors, References, Relationships, Time_of_Introduction
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2023-10-26 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2025-12-11 +00:00	updated Applicable_Platforms, Observed_Examples, References, Relationships, Weakness_Ordinalities
CWE Content Team	MITRE	2026-04-30 +00:00	updated Background_Details, Description, Diagram
CWE Content Team	MITRE	2026-10-28 +00:00	updated Observed_Examples

CWE-1004 상세 정보

CWE-1004