ABSTRACT

The program does not set the HttpCookie.HttpOnly property to true.

EXPLANATION

The default value for the httpOnlyCookies attribute is false, meaning that the cookie is accessible through a client-side script. This is an unnecessary cross-site scripting threat, resulting in stolen cookies. Stolen cookies can contain sensitive information identifying the user to the site, such as the ASP.NET session ID or forms authentication ticket, and can be replayed by the attacker in order to masquerade as the user or obtain sensitive information.


Example 1: Vulnerable configuration:


<configuration>
<system.web>
<httpCookies httpOnlyCookies="false">


REFERENCES

[1] Standards Mapping - OWASP Top 10 2004 - (OWASP 2004) A10 Insecure Configuration Management

[2] Standards Mapping - OWASP Top 10 2010 - (OWASP 2010) A6 Security Misconfiguration

[3] Standards Mapping - FIPS200 - (FISMA) CM

[4] httpCookies Element MSDN

[5] Standards Mapping - Web Application Security Consortium 24 + 2 - (WASC 24 + 2) Insufficient Authentication

[6] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 - (PCI 1.1) Requirement 6.5.10

[7] Top 10 Application Security Vulnerabilities in Web.config Files Devloper Fusion