Weakness · High
CWE-784: Reliance on Cookies without Validation and Integrity Checking in a Security Decision
What it is
The product uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user.
- Severity (our rating)
- High
- Likelihood of exploit
- High
- Introduced during
- Implementation
- Exploited in the wild
- No CVE in CISA's catalog
In more detail
Attackers can easily modify cookies, within the browser or by implementing the client-side code outside of the browser. Attackers can bypass protection mechanisms such as authorization and authentication by modifying the cookie to contain an expected value.
What an attacker can do
- Bypass Protection Mechanism (Access Control)
- Gain Privileges or Assume Identity (Access Control)
How to prevent it
Architecture and Design
- Avoid using cookie data for a security-related decision.
- Add integrity checks to detect tampering.
- Protect critical cookies from replay attacks, since cross-site scripting or other attacks may allow attackers to steal a strongly-encrypted cookie that also passes integrity checks. This mitigation applies to cookies that should only be valid during a single transaction or session. By enforcing timeouts, you may limit the scope of an attack. As part of your integrity check, use an unpredictable, server-side value that is not exposed to the client.
Implementation
- Perform thorough input validation (i.e.: server side validation) on the cookie data if you're going to use it for a security related decision.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.