CWE-1275 Sensitive Cookie with Improper SameSite Attribute

The SameSite attribute for sensitive cookies is not set, or an insecure value is used.

• Confidentiality, Integrity, Non-Repudiation, Access Control: Modify Application Data — If the "None" value is used, a website may create a cross-domain POST HTTP request to another website, and the browser automatically adds cookies to this request. This may enable Cross-Site-Request-Forgery (CSRF) attacks if there are no additional protections in place (such as Anti-CSRF tokens). The likelihood of the integrity breach is Low because a successful attack does not depend solely on an insecure SameSite attribute. In order to perform a CSRF attack, many other conditions might need to be met, such as the lack of CSRF tokens, no confirmations for sensitive actions on the website, a "simple" "Content-Type" header in the HTTP request, etc.

• [Implementation] Set the SameSite attribute of a sensitive cookie to "Lax" or "Strict". This instructs the browser to apply this cookie only to same-domain requests, which provides a good Defense in Depth against CSRF attacks. When the "Lax" value is in use, cookies are also sent for top-level cross-domain navigation via HTTP GET, HEAD, OPTIONS, and TRACE methods, but not for other HTTP methods that are more likely to cause side-effects of state mutation.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

• CVE-2022-24045: Web application for a room automation system has client-side JavaScript that sets a sensitive cookie without the SameSite security attribute, allowing the cookie to be sniffed