CWE-539, Use of Persistent Cookies Containing Sensitive Information, applies to web applications that store sensitive data in cookies that outlast the browser session.
How it happens
MITRE explains the background. Cookies are small bits of data sent by the web application and stored in the browser. Applications use them to pass information between pages and to store variable information. Typical contents are session identifiers, personalization settings and, in rare cases, usernames for automated logins.
There are two kinds. Session cookies live in browser memory and are not stored anywhere else. Persistent cookies are stored on the browser's hard drive. That difference is the whole issue. Data in a persistent cookie sits on disk after the user is done, on whatever machine they used.
A "remember me" feature is the classic source. The easy way to build it is to put the identity or credential into a long-lived cookie.
Set-Cookie: remember=user=alice&pass=hunter2; Max-Age=31536000
That cookie sits on disk for a year.
What an attacker gains
MITRE lists reading application data as the confidentiality impact. Anyone with access to the machine, such as a shared computer or a person who gets hold of a laptop, can read what the browser saved.
How to find it
- Log in with each feature that offers persistence and inspect the cookies in browser developer tools. Look at the expiry and the value.
- Search code for cookie creation with a max age or expiry date.
- Use static analysis. MITRE notes it can find some instances.
How to fix it
MITRE's mitigation is direct: do not store sensitive information in persistent cookies. Beyond that:
- Keep sensitive values on the server and store only an opaque identifier in the cookie.
- Give identifiers a limited lifetime and let the server revoke them.
- Use session cookies for anything that should end with the browser.
Quick check
What separates a persistent cookie from a session cookie?
A session cookie lives in browser memory. A persistent cookie is stored on the browser's hard drive.
