PHP-A1005 @ a6a2c30 • smalos / nubuilder

Run summary

a year ago

8e4129c..a6a2c30

1 min 57 s

Audit required: Sensitive cookie without secure attribute PHP-A1005

Security

Critical

6 occurrences in this check

a02 cwe-614 cwe-311 cwe-315 sans top 25 owasp top 10

Cookie set without "secure" flag

core/nuvendorlogin.php

54        $page = "libs/tinyfilemanager/tinyfilemanager.php";
55    }
56
57    setcookie("nu_".$appId, $_SESSION['nubuilder_session_data']['SESSION_ID']);58
59    return $page;
60}

Cookie set without "secure" flag

core/nupmalogin.php

53        $page							= "nupmalogout.php?$time=$time";
54        setcookie("nupmalogin", "bad");
55        setcookie("nuConfigDBHost", null);
56        setcookie("nuConfigDBUser", null);57        setcookie("nuConfigDBPassword", null);
58        return $page;
59    }

Cookie set without "secure" flag

core/nupmalogin.php

54        setcookie("nupmalogin", "bad");
55        setcookie("nuConfigDBHost", null);
56        setcookie("nuConfigDBUser", null);
57        setcookie("nuConfigDBPassword", null);58        return $page;
59    }

Cookie set without "secure" flag

core/nupmalogin.php

42        setcookie("nuConfigDBPassword", $_SESSION['nubuilder_session_data']['DB_PASSWORD']);
43
44        if ($_SESSION['nubuilder_session_data']['DB_PASSWORD'] == '') {
45            setcookie("nuConfigDBPasswordBlank", 'BLANK');46        }
47        return $page;
48    }

Cookie set without "secure" flag

core/nupmalogin.php

39        setcookie("nupmalogin", "good");
40        setcookie("nuConfigDBHost", $_SESSION['nubuilder_session_data']['DB_HOST']);
41        setcookie("nuConfigDBUser", $_SESSION['nubuilder_session_data']['DB_USER']);
42        setcookie("nuConfigDBPassword", $_SESSION['nubuilder_session_data']['DB_PASSWORD']);43
44        if ($_SESSION['nubuilder_session_data']['DB_PASSWORD'] == '') {
45            setcookie("nuConfigDBPasswordBlank", 'BLANK');

Cookie set without "secure" flag

core/nupmalogin.php

38        $page = "libs/nudb/db_structure.php?server=1&db=".$_SESSION['nubuilder_session_data']['DB_NAME']."&$time=$time";
39        setcookie("nupmalogin", "good");
40        setcookie("nuConfigDBHost", $_SESSION['nubuilder_session_data']['DB_HOST']);
41        setcookie("nuConfigDBUser", $_SESSION['nubuilder_session_data']['DB_USER']);42        setcookie("nuConfigDBPassword", $_SESSION['nubuilder_session_data']['DB_PASSWORD']);
43
44        if ($_SESSION['nubuilder_session_data']['DB_PASSWORD'] == '') {

Description

Cookies set without the secure flag can cause the user agent to send those cookies in plaintext over an HTTP session with the same server. This can be observed by an unauthorized person, leading to a man-in-the-middle attack.

In past it has led to the following vulnerabilities:

Generally, the production sites redirect any requests that are sent over HTTP to the same URL but on HTTPS. In this case, make sure that these HTTP requests that are immediately redirected to HTTPS do not carry any cookie that contains sensitive information. The secure flag limits cookies to HTTPS traffic only so, the browser will never send secure cookies with requests that are not encrypted.

Bad practice

// sensitive: cookie is set with 'secure' flag(6th parameter) to `false`, which can lead to security vulnerabilities in future
setcookie('user_data', 'sensitive value', time() + 3600, '', '', false);

References

Exceptions

While this issue mostly makes sense if you're setting a sensitive cookie, DeepSource will flag all the cookies encountered without the secure flag. This is to ensure that you are aware about all the cookies set, and avoid false negatives.

smalos / nubuilder_dev

Bad practice

Recommended

References

Exceptions