CVE-2014-9634 (Java, published 2017-09-12T14:29Z)
Description: value: Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session.
Severity: MEDIUM (CVSS v3 base score: 5.3)
Weakness: CWE-254 \u2014 7PK - Security Features
Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
Repository: https://github.com/jenkinsci/jenkins
Files changed:
changelog.html
core/src/main/java/hudson/WebAppMain.java
core/src/main/java/jenkins/model/JenkinsLocationConfiguration.java
Commit message: [FIXED JENKINS-25019]

A truly conforming servlet 3.0 container does not allow us to set "secure cookie" flag beyond ServletContextListener.onInitialized().
If we see that, don't scare the users.


Vulnerable code:
            // not exposing session cookie to JavaScript to mitigate damage caused by XSS
            Method setHttpOnly = scc.getMethod("setHttpOnly",boolean.class);
            setHttpOnly.invoke(sessionCookieConfig,true);

            Method setSecure = scc.getMethod("setSecure",boolean.class);
            setSecure.invoke(sessionCookieConfig,v);

Fixed code:
  <li class=bug>
    Servlet containers may refuse to let us set <a href="https://www.owasp.org/index.php/SecureFlag">secure cookie flag</a>.
    Deal with it gracefully.
    (<a href="https://issues.jenkins-ci.org/browse/JENKINS-25019">issue 25019</a>)
import java.lang.reflect.Method;
            markCookieAsHttpOnly(context);

    /**
     * Set the session cookie as HTTP only.
     *
     * @see <a href="https://www.owasp.org/index.php/HttpOnly">discussion of this topic in OWASP</a>
     */
    private void markCookieAsHttpOnly(ServletContext context) {
        try {
            Method m;
            try {
                m = context.getClass().getMethod("getSessionCookieConfig");
            } catch (NoSuchMethodException x) { // 3.0+
                LOGGER.log(Level.FINE, "Failed to set secure cookie flag", x);
                return;
            }
            Object sessionCookieConfig = m.invoke(context);

            // not exposing session cookie to JavaScript to mitigate damage caused by XSS
            Class scc = Class.forName("javax.servlet.SessionCookieConfig");
            Method setHttpOnly = scc.getMethod("setHttpOnly",boolean.class);
            setHttpOnly.invoke(sessionCookieConfig,true);
        } catch (Exception e) {
            LOGGER.log(Level.WARNING, "Failed to set HTTP-only cookie flag", e);
        }
    }

import java.lang.reflect.InvocationTargetException;
            Method setSecure = scc.getMethod("setSecure", boolean.class);
            setSecure.invoke(sessionCookieConfig, v);
        } catch (InvocationTargetException e) {
            if (e.getTargetException() instanceof IllegalStateException) {
                // servlet 3.0 spec seems to prohibit this from getting set at runtime,
                // though Winstone is happy to accept i. see JENKINS-25019
                return;
            }
            LOGGER.log(Level.WARNING, "Failed to set secure cookie flag", e);