界: Security Features

軟體安全性並非安全性軟體。我們關注驗證、Access Control、保密性、加密以及權限管理之類的主題。

Cookie Security: Overly Broad Session Cookie Domain

Java/JSP
PHP

Abstract

共用同一個基礎網域的應用程式可存取網域範圍過大的階段作業 Cookie。

Explanation

開發人員通常會將階段作業 Cookie 設為基礎網域，例如 ".example.com"。不過，這麼做會將階段作業 Cookie 揭露給基礎網域名稱及任何子網域中的所有 Web 應用程式。洩漏階段作業 Cookie 可能會造成帳戶洩漏。

範例 1：想像您已在 http://secure.example.com/ 部署安全的應用程式，且當使用者登入時，應用程式以網域「.example.com」設定工作階段 cookie。

應用程式的組態設定檔案將有下列項目：


server.servlet.session.cookie.domain=.example.com

假設您在 http://insecure.example.com/ 有另一個較不安全的應用程式，且它含有 Cross-Site Scripting 弱點。任何已向 http://secure.example.com 驗證的使用者在瀏覽 http://insecure.example.com 時，會造成向 http://secure.example.com 暴露其階段作業 Cookie 的風險。

References

[1] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001368, CCI-001414

[2] Standards Mapping - FIPS200 CM

[3] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[4] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-4 Information Flow Enforcement (P1)

[5] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-4 Information Flow Enforcement

[6] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[7] Standards Mapping - OWASP Mobile 2014 M4 Unintended Data Leakage

[8] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization

[9] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[10] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling

[11] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[12] Standards Mapping - OWASP Top 10 2013 A6 Sensitive Data Exposure

[13] Standards Mapping - OWASP Top 10 2017 A3 Sensitive Data Exposure

[14] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[15] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.3

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.5.7

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.10

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.10

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.10

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.10

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[22] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[23] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection

[24] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection

[25] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[26] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[27] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[30] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[31] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[39] Standards Mapping - Web Application Security Consortium Version 2.00 Information Leakage (WASC-13)

[40] Standards Mapping - Web Application Security Consortium 24 + 2 Information Leakage

desc.config.java.cookie_security_overly_broad_session_cookie_domain

Abstract

共享同一個基礎網域的應用程式可攻擊網域範圍過大的階段作業 cookie。

Explanation

開發人員通常會將階段作業 Cookie 設為基礎網域 (如「.example.com」)。這會將階段作業 Cookie 揭露給基礎網域及任何子網域上的所有 Web 應用程式。在應用程式間共享 Cookie 可能會使一個應用程式中的弱點，對另一個應用程式造成危害。

範例 1：
想像您已在 http://secure.example.com/ 部署安全的應用程式，且當使用者登入時，應用程式以網域「.example.com」設定工作階段 cookie。

例如：


session_set_cookie_params(0, "/", ".example.com", true, true);

假設您在 http://insecure.example.com/ 有另一個較不安全的應用程式，且它含有 Cross-site scripting 的弱點。任何已受 http://secure.example.com 驗證的使用者在瀏覽 http://insecure.example.com 時，會造成向 http://secure.example.com 暴露其階段作業 cookie 的風險。

References

[1] session_set_cookie_params The PHP Group

[2] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001368, CCI-001414

[3] Standards Mapping - FIPS200 CM

[4] Standards Mapping - General Data Protection Regulation (GDPR) Access Violation

[5] Standards Mapping - NIST Special Publication 800-53 Revision 4 AC-4 Information Flow Enforcement (P1)

[6] Standards Mapping - NIST Special Publication 800-53 Revision 5 AC-4 Information Flow Enforcement

[7] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[8] Standards Mapping - OWASP Mobile 2014 M4 Unintended Data Leakage

[9] Standards Mapping - OWASP Mobile 2024 M3 Insecure Authentication/Authorization

[10] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[11] Standards Mapping - OWASP Top 10 2007 A6 Information Leakage and Improper Error Handling

[12] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[13] Standards Mapping - OWASP Top 10 2013 A6 Sensitive Data Exposure

[14] Standards Mapping - OWASP Top 10 2017 A3 Sensitive Data Exposure

[15] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[16] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.3

[17] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.5.7

[18] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.10

[19] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.10

[20] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.10

[21] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.10

[22] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4

[23] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection

[24] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection

[25] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection

[26] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[27] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[28] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[29] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[30] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[31] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[32] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[33] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[34] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[35] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[36] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[37] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[38] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[39] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-000480 CAT II, APSC-DV-000490 CAT II

[40] Standards Mapping - Web Application Security Consortium Version 2.00 Information Leakage (WASC-13)

[41] Standards Mapping - Web Application Security Consortium 24 + 2 Information Leakage

desc.semantic.php.cookie_security_overly_broad_session_cookie_domain