CWE-1275—Sensitive Cookie with Improper SameSite Attribute

名称

Sensitive Cookie with Improper SameSite Attribute

描述

The SameSite attribute for sensitive cookies is not set, or an insecure value is used.

The SameSite attribute controls how cookies are sent for cross-domain requests. This attribute may have three values: 'Lax', 'Strict', or 'None'. If the 'None' value is used, a website may create a cross-domain POST HTTP request to another website, and the browser automatically adds cookies to this request. This may lead to Cross-Site-Request-Forgery (CSRF) attacks if there are no additional protections in place (such as Anti-CSRF tokens).

常见后果

范围：

Confidentiality, Integrity, Non-Repudiation, Access Control

影响：

Modify Application Data

注释：

If the website does not impose additional defense against CSRF attacks, failing to use the 'Lax' or 'Strict' values could increase the risk of exposure to CSRF attacks. The likelihood of the integrity breach is Low because a successful attack does not only depend on an insecure SameSite attribute. In order to perform a CSRF attack there are many conditions that must be met, such as the lack of CSRF tokens, no confirmations for sensitive actions on the website, a "simple" "Content-Type" header in the HTTP request and many more.

相关 CWE

• CWE-352Cross-Site Request Forgery (CSRF)Medium
• CWE-923Improper Restriction of Communication Channel to Intended Endpoints

相关警报

• Cookie without SameSite AttributeLow
• Cookie with SameSite Attribute NoneLow
• Cookie with Invalid SameSite AttributeLow