secure cookie fails penetration tests #6767

Activity

1. rullzer commented on Oct 5, 2017

   

   rullzer

   on Oct 5, 2017

   Member

   More actions

   @LukasReschke
2. e-alfred commented on Oct 5, 2017

   

   e-alfred

   on Oct 5, 2017

   Last edited by e-alfred

   More actions

   Openvas also produces a medium warning with this content for an instance not running in a subdirectory:

   Summary
   
   The host is running a server with SSL/TLS and is prone to information disclosure vulnerability.
   Vulnerability Detection Result
   
   The cookies:
   
   Set-Cookie: 45342agfd4=replaced; path=/; HttpOnly
   
   are missing the “secure” attribute.
   
   Solution
   
   Solution type: Mitigation Mitigation
   
   Set the ‘secure’ attribute for any cookies that are sent over a SSL/TLS connection.
   Affected Software/OS
   
   Server with SSL/TLS.
   Vulnerability Insight
   
   The flaw is due to cookie is not using ‘secure’ attribute, which allows cookie to be passed to the server by the client over non-secure channels (http) and allows attacker to conduct session hijacking attacks.
   
   Impact Level: Application
   Vulnerability Detection Method
   
   Details: SSL/TLS: Missing secure Cookie Attribute (OID: 1.3.6.1.4.1.25623.1.0.902661)
   
   Version used: $Revision: 5543 $
   
   References
   
   Other:
   https://www.owasp.org/index.php/SecureFlag2
   http://www.ietf.org/rfc/rfc2965.txt
   https://www.owasp.org/index.php/Testing_for_cookies_attributes_(OWASP-SM-002)
   
3. nickvergessen

   added

   security

   on Oct 5, 2017
4. LukasReschke commented on Oct 5, 2017

   

   LukasReschke

   on Oct 5, 2017

   Member

   More actions

   The secure flag is applied as soon as you log-in. There's not really a security issue here thus.

   👍React with 👍1Reacted by Joas Schilling
5. LukasReschke

   added

   bug

   and removed

   security

   on Oct 5, 2017
6. nextcloud-bot

   added

   staleTicket or PR with no recent activityTicket or PR with no recent activity

   on Jun 20, 2018
7. jomo commented on Nov 19, 2018

   

   jomo

   on Nov 19, 2018

   More actions

   Unfortunately this does not seem to be true, @LukasReschke.

   

   I've double checked with Firefox' "Storage" inspector and all cookies are marked as "Secure: false".
8. nextcloud-bot

   removed

   staleTicket or PR with no recent activityTicket or PR with no recent activity

   on Nov 19, 2018
9. rullzer commented on Nov 20, 2018

   

   rullzer

   on Nov 20, 2018

   Member

   More actions

   @jomo did you by any chance first access the site via plain http?
   I can't trigger this otherwise.
10. jomo commented on Nov 20, 2018

    

    jomo

    on Nov 20, 2018

    More actions

    That comment pointed me in the right direction. TLS termination is done by nginx, I should have thought of that…

    I had to add this to the config.php:

    'overwriteprotocol' => 'https'

    Can confirm it's working now, thanks!

    👍React with 👍5Reacted by Roeland Jago Douma, Prasun Gera, anothervictim, Thomas Luzat and Michel Zimmer
11. jomo commented on Nov 20, 2018

    

    jomo

    on Nov 20, 2018

    More actions

    In fact, the cookies are sent as secure even before login.

    See observatory.mozilla.org report:
    

    Guess this issue can be closed?
12. rullzer

    closed this as completedon Nov 20, 2018
13. pgera commented on Jan 13, 2019

    

    pgera

    on Jan 13, 2019

    More actions

    I just had to do this for my docker nextcloud setup. At least in my case (and I'm assuming for others too), tls is done by the nginx docker container. As a result, this test as well as the __host prefix test on scan.nextcloud.com were failing. I suppose this should be addressed on the docker-nextcloud repo as well.

    👍React with 👍1Reacted by Thomas Luzat