CVE-2014-9635 (Java, published 2017-09-12T14:29Z)
Description: value: Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-254 \u2014 7PK - Security Features
Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
changelog.html
core/src/main/java/hudson/WebAppMain.java
core/src/main/java/jenkins/model/JenkinsLocationConfiguration.java
Commit message: [FIXED JENKINS-25019]

A truly conforming servlet 3.0 container does not allow us to set "secure cookie" flag beyond ServletContextListener.onInitialized().
If we see that, don't scare the users.


Vulnerable code:
            // not exposing session cookie to JavaScript to mitigate damage caused by XSS
            Method setHttpOnly = scc.getMethod("setHttpOnly",boolean.class);
            setHttpOnly.invoke(sessionCookieConfig,true);

            Method setSecure = scc.getMethod("setSecure",boolean.class);
            setSecure.invoke(sessionCookieConfig,v);

Fixed code:
  <li class=bug>
    Servlet containers may refuse to let us set <a href="https://www.owasp.org/index.php/SecureFlag">secure cookie flag</a>.
    Deal with it gracefully.
    (<a href="https://issues.jenkins-ci.org/browse/JENKINS-25019">issue 25019</a>)
import java.lang.reflect.Method;
            markCookieAsHttpOnly(context);

    /**
     * Set the session cookie as HTTP only.
     *
     * @see <a href="https://www.owasp.org/index.php/HttpOnly">discussion of this topic in OWASP</a>
     */
    private void markCookieAsHttpOnly(ServletContext context) {
        try {
            Method m;
            try {
                m = context.getClass().getMethod("getSessionCookieConfig");
            } catch (NoSuchMethodException x) { // 3.0+
                LOGGER.log(Level.FINE, "Failed to set secure cookie flag", x);
                return;
            }
            Object sessionCookieConfig = m.invoke(context);

            // not exposing session cookie to JavaScript to mitigate damage caused by XSS
            Class scc = Class.forName("javax.servlet.SessionCookieConfig");
            Method setHttpOnly = scc.getMethod("setHttpOnly",boolean.class);
            setHttpOnly.invoke(sessionCookieConfig,true);
        } catch (Exception e) {
            LOGGER.log(Level.WARNING, "Failed to set HTTP-only cookie flag", e);
        }
    }

import java.lang.reflect.InvocationTargetException;
            Method setSecure = scc.getMethod("setSecure", boolean.class);
            setSecure.invoke(sessionCookieConfig, v);
        } catch (InvocationTargetException e) {
            if (e.getTargetException() instanceof IllegalStateException) {
                // servlet 3.0 spec seems to prohibit this from getting set at runtime,
                // though Winstone is happy to accept i. see JENKINS-25019
                return;
            }
            LOGGER.log(Level.WARNING, "Failed to set secure cookie flag", e);