CVE-2022-3174 (published 2022-09-13T10:15Z)

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-311
cwe_name: Missing Encryption of Sensitive Data
description: The product does not encrypt sensitive or critical information before storage or transmission.
extended_description: The lack of proper data encryption passes up the guarantees of confidentiality, integrity, and accountability that properly implemented encryption conveys.
         

Fix information:
repo_url: https://github.com/ikus060/rdiffweb
commit_details: repo_url: https://github.com/ikus060/rdiffweb
author: Patrik Dufresne
author_date: 2022-09-11 06:47:07-04:00
msg: Use 'Secure' Attribute with Sensitive Cookie in HTTPS Session #209
repository: repo_url: https://github.com/ikus060/rdiffweb
repo_name: ikus060/rdiffweb
description: A simplified backup management software for quick access to your archives through an efficient web interface.
repo_language: Python
owner: ikus060
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -107,9 +107,17 @@ Professional support for Rdiffweb is available by contacting [IKUS Soft](https:/
 
 # Changelog
 
+## 2.4.2 (2022-09-08)
+
+This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.
+
+* Use 'Secure' Attribute with Sensitive Cookie in HTTPS Session. [CVE-2022-3174](https://nvd.nist.gov/vuln/detail/CVE-2022-3174) #209
+
 ## 2.4.1 (2022-09-08)
 
-* Add Clickjacking Defense
+This releases include a security fix. If you are using an earlier version, you should upgrade to this release immediately.
+
+* Add Clickjacking Defense [CVE-2022-3167](https://nvd.nist.gov/vuln/detail/CVE-2022-3167)
 * Drop Ubuntu Hirsute & Impish (End-of-life)
 
 ## 2.4.0 (2022-06-21)

programming_language: Markdown
filename: test_secure_headers.py
change_type: ModificationType.RENAME
diff: @@ -22,11 +22,11 @@ Created on Oct 20, 2021
 import rdiffweb.test
 
 
-class CsrfTest(rdiffweb.test.WebCase):
+class SecureHeadersTest(rdiffweb.test.WebCase):
 
     login = True
 
-    def test_samesite_lax(self):
+    def test_cookie_samesite_lax(self):
         # Given a request made to rdiffweb
         # When receiving the response
         self.getPage('/')
@@ -34,7 +34,7 @@ class CsrfTest(rdiffweb.test.WebCase):
         cookie = self.assertHeader('Set-Cookie')
         self.assertIn('SameSite=Lax', cookie)
 
-    def test_samesite_lax_without_session(self):
+    def test_cookie_samesite_lax_without_session(self):
         # Given not a client sending no cookie
         self.cookies = None
         # When a query is made to a static path (without session)
@@ -42,6 +42,22 @@ class CsrfTest(rdiffweb.test.WebCase):
         # Then Set-Cookie is not defined.
         self.assertNoHeader('Set-Cookie')
 
+    def test_cookie_with_https(self):
+        # Given an https request made to rdiffweb
+        self.getPage('/', headers=[('X-Forwarded-Proto', 'https')])
+        # When receiving the response
+        # Then the header contains Set-Cookie with Secure
+        cookie = self.assertHeader('Set-Cookie')
+        self.assertIn('Secure', cookie)
+
+    def test_cookie_with_http(self):
+        # Given an https request made to rdiffweb
+        self.getPage('/')
+        # When receiving the response
+        # Then the header contains Set-Cookie with Secure
+        cookie = self.assertHeader('Set-Cookie')
+        self.assertNotIn('Secure', cookie)
+
     def test_get_with_wrong_origin(self):
         # Given a GET request made to rdiffweb
         # When the request is made using a different origin

programming_language: Python
filename: rdw_app.py
change_type: ModificationType.MODIFY
diff: @@ -38,7 +38,7 @@ import rdiffweb.tools.errors
 import rdiffweb.tools.i18n
 import rdiffweb.tools.proxy
 import rdiffweb.tools.ratelimit
-import rdiffweb.tools.security
+import rdiffweb.tools.secure_headers
 from rdiffweb.controller import Controller
 from rdiffweb.controller.api import ApiPage
 from rdiffweb.controller.dispatch import static  # noqa
@@ -63,6 +63,7 @@ logger = logging.getLogger(__name__)
 
 
 @cherrypy.tools.proxy()
+@cherrypy.tools.secure_headers()
 class Root(LocationsPage):
     def __init__(self):
         self.login = LoginPage()
@@ -170,7 +171,6 @@ class RdiffwebApp(Application):
                 'tools.auth_form.on': True,
                 'tools.currentuser.on': True,
                 'tools.currentuser.userobj': lambda username: self.store.get_user(username),
-                'tools.csrf.on': True,
                 'tools.i18n.on': True,
                 'tools.i18n.default': 'en_US',
                 'tools.i18n.mo_dir': pkg_resources.resource_filename('rdiffweb', 'locales'),  # @UndefinedVariable

programming_language: Python
filename: secure_headers.py
change_type: ModificationType.RENAME
diff: @@ -32,12 +32,13 @@ if not http.cookies.Morsel().isReservedKey("samesite"):
     http.cookies.Morsel._reserved['samesite'] = 'SameSite'
 
 
-class CsrfAuth(HandlerTool):
+class SecureHeaders(HandlerTool):
     """
     This tool provide CSRF mitigation.
 
     * Define X-Frame-Options = DENY
     * Define Cookies SameSite=Lax
+    * Define Cookies Secure when https is detected
     * Validate `Origin` and `Referer` on POST, PUT, PATCH, DELETE
 
     Ref.:
@@ -46,7 +47,7 @@ class CsrfAuth(HandlerTool):
     """
 
     def __init__(self):
-        HandlerTool.__init__(self, self.run, name='csrf')
+        HandlerTool.__init__(self, self.run, name='secure_headers')
         # Make sure to run before authform (priority 71)
         self._priority = 71
 
@@ -58,12 +59,18 @@ class CsrfAuth(HandlerTool):
         response = cherrypy.serving.response
         # Define X-Frame-Options to avoid Clickjacking
         response.headers['X-Frame-Options'] = 'DENY'
-        # Awaiting bug fix in cherrypy
-        # https://github.com/cherrypy/cherrypy/issues/1767
-        # Force SameSite to Lax
+
+        # Enforce security on cookies
         cookie = response.cookie.get('session_id', None)
         if cookie:
+            # Awaiting bug fix in cherrypy
+            # https://github.com/cherrypy/cherrypy/issues/1767
+            # Force SameSite to Lax
             cookie['samesite'] = 'Lax'
+            # Check if https is enabled
+            https = cherrypy.request.base.startswith('https')
+            if https:
+                cookie['secure'] = 1
 
     def run(self):
         if cherrypy.request.method in ['POST', 'PUT', 'PATCH', 'DELETE']:
@@ -73,4 +80,4 @@ class CsrfAuth(HandlerTool):
                 raise cherrypy.HTTPError(403, 'Unexpected Origin header')
 
 
-cherrypy.tools.csrf = CsrfAuth()
+cherrypy.tools.secure_headers = SecureHeaders()

programming_language: Python