Improper Cookie expiration | Cookies Expiration Set to Future
Low
W
Weblate
Submitted None
Actions:
Reported by
sadhu16
Vulnerability Details
Technical details and impact analysis
Hi Team,
I have found at many instances or places from signup till getting logged into application ( in domain "demo.weblate.org" ) that session maintaining cookies such as csrf token and session id's expiration dates are set to future date. As part of secure session management one should prohibit or avoid the use of persistent cookies specially for those cookies which contain sensitive information.Ideally application should use only cookies of non persistent nature.
Here Application is setting cookie expiration to future date.
Here an adversary may get an access to victim's cookies (session ids and csrf token ) and can reuse them in further getting valid session on behalf of them or he can directly use them for any activity which cause harm to victims.
Attached screenshots for reference please see them.
See the below mentioned link for details:
https://www.owasp.org/index.php/Testing_for_cookies_attributes_(OTG-SESS-002)
Report Details
Additional information and metadata
State
Closed
Substate
Resolved