CWE-1275Sensitive Cookie with Improper SameSite Attribute

Description

Common consequences· 1

• Confidentiality / Integrity / Non-Repudiation / Access Control — Modify Application Data
  If the website does not impose additional defense against CSRF attacks, failing to use the 'Lax' or 'Strict' values could increase the risk of exposure to CSRF attacks. The likelihood of the integrity breach is Low because a successful attack does not only depend on an insecure SameSite attribute. In order to perform a CSRF attack there are many conditions that must be met, such as the lack of CSRF tokens, no confirmations for sensitive actions on the website, a "simple" "Content-Type" header in the HTTP request and many more.

Potential mitigations· 1

• [Implementation]Set the SameSite attribute of a sensitive cookie to 'Lax' or 'Strict'. This instructs the browser to apply this cookie only to same-domain requests, which provides a good Defense in Depth against CSRF attacks. When the 'Lax' value is in use, cookies are also sent for top-level cross-domain navigation via HTTP GET, HEAD, OPTIONS, and TRACE methods, but not for other HTTP methods that are more like to cause side-effects of state mutation.

Related CAPEC attack patterns· 1

Exploits (incoming)1

(incoming)14

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.