Is running these sites in SSL a sufficient mitigating factor ?
If not, what would the severity of this finding be?
Running the sites under HTTPS is good but it will not mitigate the types of attack against the lack of
In the case of
Secure cookies without
HttpOnly, they could be read by an XSS attack should an XSS flaw exist on a site.
HttpOnly is set, but not
Secure then an attacker could force the browser to leak the cookie accross plain HTTP:
Say your website is
https://www.foo.com and you set a session ID cookie with
HttpOnly but not
Secure. If the attacker could get a user to visit their own website (or it could be a forum, etc, that the attacker has posted on) the attacker could have embedded an image tag on their own page:
<img src="http://www.foo.com/bar.jpg" />. It is not necessary for the image to exist, nor the fact that your server has port 80 open.
Secure flag is not set, the once private session ID is now leaked across an unencrypted HTTP connection as the browser will send all non
Secure cookies with the request. This would open up your application to a Man in The Middle attack. In the case of port 80 being closed on your server, the attacker could simply MITM this connection and redirect it to another server that is open.