Android : Cookie: not HttpOnly
Classification
OWASP Top 10 2013 A2-Broken Authentication and Session Management OWASP Mobile Top 10 2016 M2-Insecure Data Storage OWASP Top 10 2017 A2-Broken Authentication A3-Sensitive Data Exposure OWASP Top 10 2021 A2-Cryptographic Failures A4-Insecure Design A7-Identification and Authentication Failures OWASP ASVS Session Management PCI DSS 4.0 6.2.4 HIPAA §164.312 (e)(1) CWE CWE-732 CWE-1004 CWE-1028 CWE/SANS Top 25 2011 CWE-732 CWE/SANS Top 25 2021 CWE-732Overview
The application creates cookies without setting the httpOnly flag to true. If the httpOnly flag is included in the HTTP response header, the cookie cannot be accessed through client side script. As a result, even if a cross-site scripting (XSS) flaw exists, and a user accidentally accesses a link that exploits this flaw, the browser will not reveal the cookie to a third party. If the httpOnly flag isn’t included in the HTTP response header, the cookie (typically your session cookie) becomes vulnerable to theft of modification by malicious script.
Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.
References
