CVE-2023-3520 (published 2023-07-06T01:15Z)

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository it-novum/openitcockpit prior to 4.6.6.

CVSS v3 base score: 4.6, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)

Weakness information:
cwe_id: CWE-614
cwe_name: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
description: The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.
extended_description: 
            
         
         

Fix information:
repo_url: https://github.com/it-novum/openitcockpit
commit_details: repo_url: https://github.com/it-novum/openitcockpit
author: nook24
author_date: 2023-06-15 10:03:44+02:00
msg: ITC-3039 Set all cookies with secure=true. Many thanks to https://github.com/uonghoangminhchau for reporting this
repository: repo_url: https://github.com/it-novum/openitcockpit
repo_name: it-novum/openITCOCKPIT
description: openITCOCKPIT is an Open Source system monitoring tool built for different monitoring engines like Nagios, Naemon and Prometheus.
repo_language: PHP
owner: it-novum
file_changes: filename: routes.php
change_type: ModificationType.MODIFY
diff: @@ -56,6 +56,7 @@ $routes->scope('/', function (RouteBuilder $builder) {
     // Register scoped middleware for in scopes.
     $csrf = new CsrfProtectionMiddleware([
         'httponly' => true,
+        'secure'   => true
     ]);
 
     // Token check will be skipped when callback returns `true`.

programming_language: PHP
filename: Application.php
change_type: ModificationType.MODIFY
diff: @@ -111,7 +111,8 @@ class Application extends BaseApplication implements AuthenticationServiceProvid
     public function routes($routes): void {
         // Register scoped middleware for use in routes.php
         $routes->registerMiddleware('csrf', new CsrfProtectionMiddleware([
-            'httponly' => true
+            'httponly' => true,
+            'secure'   => true
         ]));
 
         parent::routes($routes);
@@ -189,7 +190,9 @@ class Application extends BaseApplication implements AuthenticationServiceProvid
             'rememberMeField' => 'remember_me',
             'fields'          => $fields,
             'cookie'          => [
-                'expires' => $expireAt
+                'expires'  => $expireAt,
+                'httponly' => true,
+                'secure'   => true
             ]
         ]);
         $service->loadAuthenticator('Authentication.Session');

programming_language: PHP
filename: StatisticsController.php
change_type: ModificationType.MODIFY
diff: @@ -98,7 +98,9 @@ class StatisticsController extends AppController {
                 'askAgainForHelp',
                 'Remind me later',
                 new \DateTime('+16 hours'),
-                '/'
+                '/',
+                null,
+                true
             ));
         }
 

programming_language: PHP
filename: CSRF.php
change_type: ModificationType.DELETE
diff: @@ -1,179 +0,0 @@
-<?php
-// Copyright (C) <2018>  <it-novum GmbH>
-//
-// This file is dual licensed
-//
-// 1.
-//  This program is free software: you can redistribute it and/or modify
-//  it under the terms of the GNU General Public License as published by
-//  the Free Software Foundation, version 3 of the License.
-//
-//  This program is distributed in the hope that it will be useful,
-//  but WITHOUT ANY WARRANTY; without even the implied warranty of
-//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-//  GNU General Public License for more details.
-//
-//  You should have received a copy of the GNU General Public License
-//  along with this program.  If not, see <http://www.gnu.org/licenses/>.
-//
-// 2.
-//  If you purchased an openITCOCKPIT Enterprise Edition you can use this file
-//  under the terms of the openITCOCKPIT Enterprise Edition license agreement.
-//  License agreement and license key will be shipped with the order
-//  confirmation.
-
-namespace itnovum\openITCOCKPIT\Core\Security;
-
-
-class CSRF {
-
-    /**
-     * @var \SessionComponent
-     */
-    protected $Session;
-
-    /**
-     * strtotime compatible string
-     * Set time how long a token is valide
-     * @var string
-     */
-    protected $csrfExpires = '+30 minutes';
-
-    /**
-     * Maximum number of tokens stored in session
-     * @var int
-     */
-    protected $csrfLimit = 150;
-
-    /**
-     * Remove CSRF tokens after use
-     * Can cause issues for Single Page applications
-     * @var boolean
-     */
-    protected $csrfUseOnce = true;
-
-    /**
-     * Token length
-     * @var int
-     */
-    protected $length = 16;
-
-    /**
-     * Token storage from and for $_SESSION
-     * @var array
-     */
-    protected $tokens = [];
-
-    /**
-     * CSRF constructor.
-     * @param \SessionComponent $Session
-     */
-    public function __construct(\SessionComponent $Session) {
-        $this->Session = $Session;
-
-        $tokens = $this->readTokens();
-        $this->tokens = $this->expireTokens($tokens);
-    }
-
-    /**
-     * @return array
-     */
-    protected function readTokens() {
-        $csrf = $this->Session->read('_csrf');
-
-        $tokens = [];
-        if (isset($csrf['csrfTokens'])) {
-            $tokens = $csrf['csrfTokens'];
-            if (!is_array($tokens)) {
-                $tokens = [];
-            }
-        }
-
-        return $tokens;
-    }
-
-    /**
-     * @param array $tokens
-     * @return array
-     */
-    protected function expireTokens($tokens) {
-        $now = time();
-        foreach ($tokens as $nonce => $expires) {
-            if ($expires < $now) {
-                unset($tokens[$nonce]);
-            }
-        }
-        $overflow = count($tokens) - $this->csrfLimit;
-        if ($overflow > 0) {
-            //Remove oldest tokens
-            asort($tokens);
-            $tokens = array_slice($tokens, $overflow + 1, null, true);
-        }
-        return $tokens;
-    }
-
-    /**
-     * @return string
-     */
-    private function _generateToken() {
-        if ($this->length < 16) {
-            throw new \SecurityException('Token length needs to be >= 16!');
-        }
-
-        return hash('sha512', openssl_random_pseudo_bytes($this->length));
-    }
-
-    /**
-     * @param \Controller $Controller
-     * @return bool
-     */
-    public function validateCsrfToken(\Controller $Controller) {
-        $requestToken = $Controller->request->data('_csrfToken');
-
-        if (!$requestToken) {
-            throw new \SecurityException('Missing CSRF token');
-        }
-
-        if (!isset($this->tokens[$requestToken])) {
-            throw new \SecurityException('CSRF token mismatch');
-        }
-
-        if ($this->tokens[$requestToken] < time()) {
-            throw new \SecurityException('CSRF token expired');
-        }
-
-        if (isset($this->tokens[$requestToken])) {
-
-            if ($this->csrfUseOnce) {
-                unset($this->tokens[$requestToken]);
-            }
-            return true;
-        }
-
-        $this->blackhole();
-    }
-
-    /**
-     * Generate a new Token stores it to $_SESSION and return the current token
-     * @return string
-     */
-    public function generateToken() {
-        $newToken = $this->_generateToken();
-        $this->tokens[$newToken] = strtotime($this->csrfExpires);
-
-        $csrf = [
-            'latestToken' => $newToken,
-            'csrfTokens'  => $this->tokens
-        ];
-
-        $this->Session->write('_csrf', $csrf);
-
-        return $newToken;
-    }
-
-
-    public function blackhole() {
-        throw new \BadRequestException(__d('cake_dev', 'The request has been black-holed'));
-    }
-
-}

programming_language: unknown
filename: AdministratorsDebugController.js
change_type: ModificationType.MODIFY
diff: @@ -312,12 +312,12 @@ angular.module('openITCOCKPIT')
         });
 
         $scope.setXdebugCookie = function(){
-            $.cookie('XDEBUG_TRIGGER', 'true');
+            $.cookie('XDEBUG_TRIGGER', 'true', {secure: true});
             $scope.hasXdebugCookie = true;
         };
 
         $scope.removeXdebugCookie = function(){
-            $.removeCookie('XDEBUG_TRIGGER');
+            $.removeCookie('XDEBUG_TRIGGER', {secure: true});
             $scope.hasXdebugCookie = false;
         };
 

programming_language: JavaScript