Missing Secure Flag on the SSL Cookie after a vulnerability assessment ran on PA820

cancel
Showing results for 
Search instead for 
Did you mean: 

Missing Secure Flag on the SSL Cookie after a vulnerability assessment ran on PA820

L4 Transporter

In my case, the team is performing a vulnerability assessment on PA820

Vulnerability Title: Missing Secure Flag From SSL Cookie 

Description: The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted requests. If the application can be accessed over both HTTP and HTTPS, then there is the potential that the cookie can be sent in cleartext.

 

The scanning was running to the MGMT IP,

 

How to find out the Missing Secure Flag on the SSL Cookie

5 REPLIES 5

Community Team Member

Hi @Mohammed_Yasin ,

 

https://live.paloaltonetworks.com/t5/threat-vulnerability-discussions/check-and-help-resolving-vapt-...

 

I'd recommend reaching out to support with the findings of your vulnerability assessment.

 

Cheers,

-Kiwi.

 
LIVEcommunity team member, CISSP
Cheers,
Kiwi
Don't forget to hit that Like button if a post is helpful to you!

Hi @Mohammed_Yasin - Have you got any updates about this vulnerability. If yes, can you pls share?

 

L0 Member

The cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope.

rapidfs

Community Team Member

Hi @ManojV5 ,

 

Could be a false positive as the secure flag is set when I check on my lab (PA-VM running 9.1 and 10.1) ... unfortunately I don't have a PA-820 to test but you can easily verify yourself with the command:

$ curl -k -i https://<yourIP> /php/login.php

 

Feel free to run the same command on your device and check the response (notice the secure flag is set in Set-Cookie in both my responses): 

 

AMSMAC60KYG8WL:~ kwens$ curl -k -i https://192.168.0.207/php/login.php >>>>> PAN-OS 9.1
HTTP/1.1 200 OK
Date: Wed, 02 Feb 2022 12:46:56 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-FRAME-OPTIONS: DENY
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;
Strict-Transport-Security: max-age=31536000
Set-Cookie: PHPSESSID=95a09564ecf30d16912f68458c038b57; path=/; HttpOnly; SameSite=Strict; secure; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Allow: GET, HEAD, POST, PUT, DELETE, OPTIONS


AMSMAC60KYG8WL:~ kwens$ curl -k -i https://192.168.0.75/php/login.php >>>>> PAN-OS 10.1
HTTP/1.1 200 OK
Date: Wed, 02 Feb 2022 12:41:03 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-FRAME-OPTIONS: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:
Strict-Transport-Security: max-age=31536000
Set-Cookie: PHPSESSID=5420dde555d4512fd0ba4a4129b57581; path=/; HttpOnly; SameSite=Strict; secure; HttpOnly
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Allow: GET, HEAD, POST, PUT, DELETE, OPTIONS

 

Unless they are checking for something else it seems to me that the secure flag is set correctly.

 

Hope this helps,

-Kiwi.

LIVEcommunity team member, CISSP
Cheers,
Kiwi
Don't forget to hit that Like button if a post is helpful to you!

Hi @kiwi - Thanks, I will be checking it.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!