CWE-565: Reliance on Cookies without Validation and Integrity Checking
Reliance on Cookies without Validation and Integrity Checking
Weakness ID: 565 (Weakness Base)
Status: Incomplete
Description
Description Summary
The application relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
Extended Description
Attackers can easily modify cookies, within the browser or by implementing the client-side code outside of the browser. Reliance on cookies without detailed validation and integrity checking can allow attackers to bypass authentication, conduct injection attacks such as SQL injection and cross-site scripting, or otherwise modify inputs in unexpected ways.
Time of Introduction
Architecture and Design
Implementation
Common Consequences
Scope
Effect
Access Control
Technical Impact: Gain privileges / assume
identity
It is dangerous to use cookies to set a user's privileges. The cookie
can be manipulated to escalate an attacker's privileges to an
administrative level.
Demonstrative Examples
Example 1
The following code excerpt reads a value from a browser cookie to
determine the role of the user.
(Bad Code)
Example
Language: Java
Cookie[] cookies = request.getCookies();
for (int i =0; i< cookies.length; i++) {
Cookie c = cookies[i];
if (c.getName().equals("role")) {
userRole = c.getValue();
}
}
Potential Mitigations
Phase: Architecture and Design
Avoid using cookie data for a security-related decision.
Phase: Implementation
Perform thorough input validation (i.e.: server side validation) on
the cookie data if you're going to use it for a security related
decision.
Phase: Architecture and Design
Add integrity checks to detect tampering.
Phase: Architecture and Design
Protect critical cookies from replay attacks, since cross-site
scripting or other attacks may allow attackers to steal a
strongly-encrypted cookie that also passes integrity checks. This
mitigation applies to cookies that should only be valid during a single
transaction or session. By enforcing timeouts, you may limit the scope
of an attack. As part of your integrity check, use an unpredictable,
server-side value that is not exposed to the client.
This problem can be primary to many types of weaknesses in web
applications. A developer may perform proper validation against URL
parameters while assuming that attackers cannot modify cookies. As a result,
the program might skip basic input validation to enable cross-site
scripting, SQL injection, price tampering, and other attacks..
Clarified name and description; broadened the definition
to include any security-critical operation, not just security decisions, to
allow for relationships with injection weaknesses.
Description
