CWE-1275: Sensitive Cookie with Improper SameSite Attribute

What is Sensitive Cookie with Improper SameSite Attribute?

• Overview: This vulnerability occurs when a sensitive cookie's SameSite attribute is either not set or is set to an insecure value. This attribute should control the sending of cookies in cross-domain requests to prevent unauthorized actions on a user's behalf.

• Exploitation Methods:

• Attackers can exploit this vulnerability by crafting cross-site requests that trick a user's browser into making unauthorized requests.
• Common attack patterns include Cross-Site Request Forgery (CSRF) attacks, where a user unknowingly performs actions on a site where they are authenticated.

• Security Impact:

• Direct consequences include unauthorized actions performed by attackers, potentially leading to data breaches or unauthorized data changes.
• Potential cascading effects include loss of user trust and exposure of sensitive user data.
• Business impact can include legal liabilities, financial loss, and damage to brand reputation.

• Prevention Guidelines:

• Set the SameSite attribute to 'Lax' or 'Strict' for sensitive cookies to limit their availability to same-site requests.
• Implement additional CSRF protections, such as Anti-CSRF tokens, to further mitigate risks.
• Regularly audit and update cookie handling practices and configurations.
• Use recommended frameworks and tools that offer built-in support for secure cookie management, such as modern web development frameworks that handle SameSite attributes correctly.

Corgea can automatically detect and fix Sensitive Cookie with Improper SameSite Attribute in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Medium

Affected Languages: Not Language-Specific

Affected Technologies: Web Based

Vulnerable Code Example

const express = require('express');
const app = express();

// Vulnerable: The SameSite attribute is not set, which can lead to CSRF attacks
app.use((req, res, next) => {
    res.cookie('sessionId', '1234567890abcdef', { secure: true, httpOnly: true }); // Missing SameSite attribute
    next();
});

app.listen(3000, () => {
    console.log('Server is running on port 3000');
});

Explanation:

• Lines 10-12: The cookie is set without specifying the SameSite attribute, making it vulnerable to Cross-Site Request Forgery (CSRF) attacks. Without SameSite, the cookie can be sent along with cross-origin requests, which is undesirable for session cookies. This can allow an attacker to perform actions on behalf of the user without their consent.

How to fix Sensitive Cookie with Improper SameSite Attribute?

The SameSite attribute is a security feature that helps mitigate the risk of CSRF attacks by controlling how cookies are sent with cross-site requests. The SameSite attribute can have three values:

• Strict: Cookies will not be sent with cross-site requests, providing the highest level of protection against CSRF.
• Lax: Cookies are not sent on cross-site subrequests (such as images or frames) but are sent when a user navigates to the origin site (e.g., following a link).
• None: Cookies will be sent with all requests, but this requires the Secure attribute to be set as well.

For session cookies, it's recommended to use SameSite=Lax or SameSite=Strict depending on the application requirements. Using SameSite=None is discouraged unless absolutely necessary and should always be accompanied by the Secure attribute.

Fixed Code Example

const express = require('express');
const app = express();

// Fixed: Set the SameSite attribute to 'Lax' to prevent CSRF attacks while maintaining basic functionality
app.use((req, res, next) => {
    res.cookie('sessionId', '1234567890abcdef', {
        secure: true,    // Ensures the cookie is only sent over HTTPS
        httpOnly: true,  // Prevents JavaScript from accessing the cookie
        sameSite: 'Lax'  // Allows cookies to be sent with top-level navigations and will block them with cross-site subrequests
    });
    next();
});

app.listen(3000, () => {
    console.log('Server is running on port 3000');
});

Explanation:

• Line 14: The sameSite attribute is set to 'Lax'. This setting allows the session cookie to be sent along with top-level navigations, which is typically sufficient for most web applications while still protecting against CSRF attacks.
• The secure and httpOnly flags are preserved to ensure the cookie is transmitted securely and is inaccessible via JavaScript, respectively. This combination of attributes helps to secure the session cookie against various attack vectors.