7

I was running Wireshark while using a website, when I noticed a session cookie storing in cleartext the email address, my first name, my gender and the date of birth I set during the signup process.

In my opinion, it is a vulnerability because it allows an attacker who is sniffing the traffic to retrieve personal data that are useless to manage the session (why do they even need to store my date of birth in a cookie?) and that, in any case, shouldn't be sent in cleartext.

Before sending a report to the website, I would like to be sure about the proper term for this vulnerability. I browsed through the CWE website (http://cwe.mitre.org/), and I think this should either be an example of CWE-315: Cleartext Storage of Sensitive Information in a Cookie or a case of CWE - 319 : Cleartext Transmission of Sensitive Information.

My two (strictly related) questions are:

  1. are the information listed above (date of birth, gender, first name, email address) considered sensitive information in the sense of the CWE definitions? The server is located in a EU country, if that helps;
  2. If they are indeed sensitive data, is this an example of CWE-315, CWE-319, both, or something else entirely?
  • Do they have a bug/vulnerability tracker to submit it to, instead of emailing it? This is interesting sleuthing work and an interesting question. – Brent Kirkpatrick Mar 21 '16 at 1:21
  • @BrentKirkpatrick not that I know of, but I'll keep looking for something like this. – A. Darwin Mar 21 '16 at 7:26
6
  1. Yes, this information should be considered sensitive, particularly in the aggregate. E-mail addresses are always PII, and adding date of birth, gender, and first name only makes it even more so.

  2. It is definitely an example of CWE-315. It may be an example of CWE-319 as well, if the cookie is ever transmitted over HTTP. If it is only ever transmitted over HTTPS, it is not a CWE-319 issue.

I agree that regardless of whether HTTPS is required or not, this is definitely a issue that you should report them. This is not an acceptable practice, and more so if the cookie is a persistent cookie, and not just an in-memory session cookie.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.