CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag

The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.

• Confidentiality: Read Application Data — If the HttpOnly flag is not set, then sensitive information stored in the cookie may be exposed to unintended parties. • Integrity: Gain Privileges or Assume Identity — If the cookie in question is an authentication cookie, then not setting the HttpOnly flag may allow an adversary to steal authentication data (e.g., a session ID) and assume the identity of the user.

• [Implementation] Leverage the HttpOnly flag when setting a sensitive cookie in a response.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

• CVE-2024-47833: python library for ML and data science does not use the Secure flag (CWE-614) or HTTPOnly security attribute (CWE-1004) for session cookies. • CVE-2022-24045: Web application for a room automation system has client-side Javascript that sets a sensitive cookie without the HTTPOnly security attribute, allowing the cookie to be accessed. • CVE-2014-3852: CMS written in Python does not include the HTTPOnly flag in a Set-Cookie header, allowing remote attackers to obtain potentially sensitive information via script access to this cookie. • CVE-2015-4138: Appliance for managing encrypted communications does not use HttpOnly flag.