Tên: Reliance on Cookies without Validation and Integrity Checking in a Security Decision

The product uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user.

Thông tin chung

Các cách xuất hiện

Implementation

Nền tảng áp dụng

Ngôn ngữ

Lớp: Not Language-Specific (Undetermined)

Công nghệ

Lớp: Web Based (Often)
Tên: Web Server (Undetermined)

Hậu quả phổ biến

Phạm vi	Tác động	Khả năng xảy ra
Access Control	Bypass Protection Mechanism, Gain Privileges or Assume Identity Ghi chú: It is dangerous to use cookies to set a user's privileges or perform other security-critical actions. Attackers can easily modify cookies, within the browser or by implementing the client-side code outside of the browser. The cookie can be manipulated to claim a high level of authorization, or to claim that successful authentication has occurred.

Ví dụ đã quan sát

Tài liệu tham khảo	Mô tả
CVE-2009-1549	Attacker can bypass authentication by setting a cookie to a specific value.
CVE-2009-1619	Attacker can bypass authentication and gain admin privileges by setting an "admin" cookie to 1.
CVE-2009-0864	Content management system allows admin privileges by setting a "login" cookie to "OK."
CVE-2008-5784	e-dating application allows admin privileges by setting the admin cookie to 1.
CVE-2008-6291	Web-based email list manager allows attackers to gain admin privileges by setting a login cookie to "admin."

Các biện pháp giảm thiểu tiềm năng

Phases : Architecture and Design
Avoid using cookie data for a security-related decision.
Phases : Implementation
Perform thorough input validation (i.e.: server side validation) on the cookie data if you're going to use it for a security related decision.
Phases : Architecture and Design
Add integrity checks to detect tampering.
Phases : Architecture and Design
Protect critical cookies from replay attacks, since cross-site scripting or other attacks may allow attackers to steal a strongly-encrypted cookie that also passes integrity checks. This mitigation applies to cookies that should only be valid during a single transaction or session. By enforcing timeouts, you may limit the scope of an attack. As part of your integrity check, use an unpredictable, server-side value that is not exposed to the client.

Ghi chú ánh xạ lỗ hổng

Lý do : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Ghi chú

A new parent might need to be defined for this entry. This entry is specific to cookies, which reflects the significant number of vulnerabilities being reported for cookie-based authentication in CVE during 2008 and 2009. However, other types of inputs - such as parameters or headers - could also be used for similar authentication or authorization. Similar issues (under the Research view) include CWE-247 and CWE-472.

Tài liệu tham khảo

REF-706

Unforgivable Vulnerabilities
Steve Christey.
http://cve.mitre.org/docs/docs-2007/unforgivable.pdf

REF-7

Writing Secure Code
Michael Howard, David LeBlanc.
https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223

Gửi

Tên	Tổ chức	Ngày	Ngày phát hành	Version
CWE Content Team	MITRE	2009-07-16 +00:00	2009-07-27 +00:00	1.5

Sửa đổi

Tên	Tổ chức	Ngày	Bình luận
CWE Content Team	MITRE	2009-10-29 +00:00	updated Relationships
CWE Content Team	MITRE	2010-02-16 +00:00	updated Demonstrative_Examples, References, Relationships
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2017-01-19 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Modes_of_Introduction, References, Relationships
CWE Content Team	MITRE	2018-03-27 +00:00	updated References
CWE Content Team	MITRE	2020-02-24 +00:00	updated Applicable_Platforms, Relationships
CWE Content Team	MITRE	2021-10-28 +00:00	updated Relationships
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Modes_of_Introduction, Relationships, Time_of_Introduction
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-12-11 +00:00	updated Applicable_Platforms, Relationships, Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Description

Chi tiết CWE-784

CWE-784