I have a situation where we are performing external PCI compliance scans against our Globalscape EFT server. The scan is reporting:
HTTP (443/tcp) - Web Application Cookies Not Marked Secure
Per our external PCI compliance vendor:
The cookies that need to be addressed are passchangesession and loginsession which are found in the Details section to the left of the Exception Request tab. For each, we need the following information: The name of the cookie detected A description of what the detected cookie's purpose is (e.g., load balancing, third-party tracking) If the cookies are session cookies, then the secure flag needs to be set and a rescan done to demonstrate this change.
Cookies in question:
Name : passchangesession Name : loginsession
I have confirmed they are session cookies. But Globalscape has not provided a solution on how to set the secure flag. All EFT traffic is also restricted to TLS 1.2 HTTPS and we deny HTTP. But this is not an acceptable compensating control, or invalid finding per vendor.
Globalscapes response was:
EFT Server does secure its session cookies when accessed over HTTPS (HTTP over SSL). What the scanner is picking up is a special case where the server is being accessed over plain-text HTTP, and EFT Server is redirecting the session temporarily over to HTTPS (to secure the login sequence), and subsequently (post login), back to HTTP. In the case of plain-text HTTP sessions, the secure flag should not be set for cookies. Please refer to the recommendations section below for more information.
Has anyone else been able to mitigate this and/or get an exception approved?