4

I was tasked to perform as scan against a lab and Nessus returned an "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability. What I would like to know is what these cookies contain and how are they exploited.

4

The cookies could contain anything, and the vulnerability isn't as much about what they contains, as it's about the fact that they can be accessed. The "Apache HTTP Server httpOnly Cookie Information Disclosure" vulnerability is, in combination with for example a XSS attack, a way to get access to the contents of cookies carrying the httpOnly-flag.


An example

In a lot of web applications, when you sign in, your session id is usually stored in a cookie in your browser. As long as the cookie is present, it will be sent along with your requests to the web application, so that the web application knows you're logged in. However, if an adversary were to steal that cookie, they could add that cookie to their own browser, and the web application would think the adversary is in fact you.

A way to mitigate this, is to set the HttpOnly flag on the cookie holding the session id.

OWASP has a good explanation of what the httpFlag is:

HttpOnly is an additional flag included in a Set-Cookie HTTP response header. Using the HttpOnly flag when generating a cookie helps mitigate the risk of client side script accessing the protected cookie (if the browser supports it).

This means that if the HttpOnly flag is set in the cookie, the cookie can't be access through client side scripting in modern browsers. Because of this, even if the site has a cross-site scripting (XSS) vulnerability and an adversary exploits a user using this flaw, you will not have access to the cookie.

But..

Because of the "Apache HTTP Server httpOnly Cookie Information Disclosure" (Also known as CVE-2012-0053) we can that to get access to the HttpOnly cookies anyways! Which is a major security issue! To protect against this, upgrading Apache is of great importance. CVE-2012-0053 is present in Apache HTTP Server 2.2.x through 2.2.21. (Newest is per 11.07.15 version 2.4.12)

You can find more information about the specifics on Tenable (creator of Nessus): http://www.tenable.com/plugins/index.php?view=single&id=57792

Description :

The version of Apache HTTP Server running on the remote host has an information disclosure vulnerability. Sending a request with HTTP headers long enough to exceed the server limit causes the web server to respond with an HTTP 400. By default, the offending HTTP header and value are displayed on the 400 error page. When used in conjunction with other attacks (e.g., cross-site scripting), this could result in the compromise of httpOnly cookies.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.