CWE-565: Reliance on Cookies without Validation and Integrity Checking
Reliance on Cookies without Validation and Integrity Checking
Weakness ID: 565 (Weakness Base)
Status: Incomplete
Description
Description Summary
The application relies on the existence or values of cookies
when performing security-critical operations, but it does not properly ensure
that the setting is valid for the associated user.
Extended Description
Attackers can easily modify cookies, within the browser or by implementing
the client-side code outside of the browser. Reliance on cookies without
detailed validation and integrity checking can allow attackers to bypass
authentication, conduct injection attacks such as SQL injection and
cross-site scripting, or otherwise modify inputs in unexpected ways.
Time of Introduction
Architecture and Design
Implementation
Common Consequences
Scope
Effect
Authorization
It is dangerous to use cookies to set a user's privileges. The cookie
can be manipulated to escalate an attacker's privileges to an
administrative level.
Demonstrative Examples
Example 1
The following code excerpt reads a value from a browser cookie to
determine the role of the user.
(Bad Code)
Java
Cookie[] cookies = request.getCookies();
for (int i =0; i< cookies.length; i++) {
Cookie c = cookies[i];
if (c.getName().equals("role")) {
userRole = c.getValue();
}
}
Potential Mitigations
Phase
Description
Architecture and Design
Avoid using cookie data for a security-related decision.
Implementation
Perform thorough input validation (i.e.: server side validation) on
the cookie data if you're going to use it for a security related
decision.
Architecture and Design
Add integrity checks to detect tampering.
Architecture and Design
Protect critical cookies from replay attacks, since cross-site
scripting or other attacks may allow attackers to steal a
strongly-encrypted cookie that also passes integrity checks. This
mitigation applies to cookies that should only be valid during a single
transaction or session. By enforcing timeouts, you may limit the scope
of an attack. As part of your integrity check, use an unpredictable,
server-side value that is not exposed to the client.
This problem can be primary to many types of weaknesses in web
applications. A developer may perform proper validation against URL
parameters while assuming that attackers cannot modify cookies. As a result,
the program might skip basic input validation to enable cross-site
scripting, SQL injection, price tampering, and other attacks..
updated Potential Mitigations,
Time of Introduction
2008-09-08
CWE Content Team
MITRE
Internal
updated Relationships, Other Notes,
Taxonomy Mappings
2009-01-12
CWE Content Team
MITRE
Internal
updated Common Consequences, Description, Other Notes,
Potential Mitigations, Relationships
2009-07-16
(Critical)
CWE Content Team
MITRE
Internal
Clarified name and description; broadened the definition
to include any security-critical operation, not just security decisions, to
allow for relationships with injection weaknesses.
Description
