Weakness (CWE)
CWE-565: Reliance on Cookies without Validation and Integrity Checking
The product relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
How to prevent it (4 mitigations)
-
Architecture and Design
Avoid using cookie data for a security-related decision.
-
Implementation
Perform thorough input validation (i.e.: server side validation) on the cookie data if you're going to use it for a security related decision.
-
Architecture and Design
Add integrity checks to detect tampering.
-
Architecture and Design
Protect critical cookies from replay attacks, since cross-site scripting or other attacks may allow attackers to steal a strongly-encrypted cookie that also passes integrity checks. This mitigation applies to cookies that should only be valid during a single transaction or session. By enforcing timeouts, you may limit the scope of an attack. As part of your integrity check, use an unpredictable, server-side value that is not exposed to the client.
Source: MITRE CWE-565
53 results · Feed
-
Critical 10.0
Socomec MOD3GP-SY-120K Reliance on Cookies without Validation and Integrity Checking
Session management within the web application is incorrect and allows attackers to steal session cookies to perform a multitude of actions that the web app allows on the device.
-
Unscored —
Client-side enforcement of server-side security issue exists in WL-WN531AX2 firmware versions prior to 2023526, which m…
-
Critical 9.8
CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.
-
Medium 5.3
ReactPHP's HTTP server parses encoded cookie names so malicious `__Host-` and `__Secure-` cookies can be sent
ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. In ReactPHP's HTTP server component versions starting with 0.7.0 and prior to 1.7.0, when ReactPHP is processing incoming HTTP cookie values, the cookie names are url-decoded. Th…
-
High 8.0
Cross-domain cookie leakage in Guzzle
Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the Set-Cooki…
-
High 7.5
Cookie Prefix Spoofing in CGI::Cookie.parse
CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.
-
High 8.3
Secure/signed cookies share secrets between sites in rails_multisite
rails_multisite provides multi-db support for Rails applications. In affected versions this vulnerability impacts any Rails applications using `rails_multisite` alongside Rails' signed/encrypted cookies. Depending on how the application makes use of these coo…
-
Medium 6.3
Reliance on Cookies without Validation and Integrity Checking in getgrav/grav
grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking
-
High 8.8
Circutor SGE-PLC1000 improper authentication
Improper Authentication vulnerability in the cookie parameter of Circutor SGE-PLC1000 firmware version 0.9.2b allows an attacker to perform operations as an authenticated user. In order to exploit this vulnerability, the attacker must be within the network wh…
-
Medium 6.5
Lack of protection against cookie tossing attacks in fastify-csrf
fastify-csrf is an open-source plugin helps developers protect their Fastify server against CSRF attacks. Versions of fastify-csrf prior to 3.1.0 have a "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "her…
-
Medium 6.1
Reliance on Cookies without validation in OctoberCMS
In OctoberCMS before version 1.0.468, encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code (nothing explo…
-
High 7.5
Centreon Does Not Set HTTPOnly Flag
In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.
-
Unscored —
A Reliance on Cookies without Validation and Integrity Checking issue was discovered in Moxa OnCell G3100-HSPA Series v…