Uploaded image for project: 'OFBiz'
  1. OFBiz
  2. OFBIZ-1525 Issue to group security concerns
  3. OFBIZ-11470

Ensure that the SameSite attribute is set to 'strict' for all cookies. (CVE-2019-0235)

    XMLWordPrintableJSON

    Details

    • Type: Sub-task
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: Trunk
    • Fix Version/s: 18.12.01, 17.12.02
    • Component/s: ALL APPLICATIONS
    • Labels:
      None
    • Sprint:
      Bug Crush Event - 21/2/2015

      Description

      As reported by OWASP ZAP:

      A cookie has been set without the SameSite attribute, which means that the cookie can be sent as a result of a 'cross-site' request. The SameSite attribute is an effective counter measure to cross-site request forgery, cross-site script inclusion, and timing attacks.

      The solution was not obvious in OFBiz for 2 reasons:

      1. There is no HttpServletResponse::setHeader. So we need to use a filter (SameSiteFilter) and even that is not enough because of 2:
      2. To prevent session fixation we force Tomcat to generates a new jsessionId, ultimately put in cookie, in LoginWorker::login. So we need to add a call to SameSiteFilter::addSameSiteCookieAttribute in UtilHttp::setResponseBrowserDefaultSecurityHeaders.

        Attachments

          Activity

            People

            • Assignee:
              jleroux Jacques Le Roux
              Reporter:
              jleroux Jacques Le Roux
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: