Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

No HTTP Only Flag Allow An Attacker TO Access Cookies Using XSS Attack

#1236

What is HTTP Only Flag - According To OWASP

If the HttpOnly flag (optional) is included in the HTTP response header, the cookie cannot be accessed through client side script (again if the browser supports this flag). As a result, even if a cross-site scripting (XSS) flaw exists, and a user accidentally accesses a link that exploits this flaw, the browser (primarily Internet Explorer) will not reveal the cookie to a third party.

Your cookies are not set as http only flag thats why an attacker can hijack the session cookies by using XSS attack , for further attacks like session hijacking

POC attached with this ticked

Reported by Narendra Bhati · November 16th, 2014 @ 11:38 AM

State: new
Milestone: User issues
Assigned to: expNinja expNinja

Activity

  1. Narendra Bhati
    Narendra Bhati
    • Tag set to security

    November 16th, 2014 @ 12:02 PM

  2. Narendra Bhati
    Narendra Bhati

    Any Update ?

    November 17th, 2014 @ 06:10 AM

  3. Narendra Bhati
    Narendra Bhati
    • Assigned user set to expNinja

    So what your are going to do next ? about this issue !

    December 20th, 2014 @ 02:03 PM

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.