1321753 - SOP violation - Sending the Session ID

Status: RESOLVED INVALID

(Core :: DOM: Core & HTML, defect, P2)

Description

[Shinto K Anto]

Attachment: SOP Violation.docx

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36

Steps to reproduce:

While sending a cross origin request, Mozilla is sending the cookies which contains sensitive information like session ID to a different domain. this will enable the attacker to steal this information as he has the complete control over the first origin domain. 


Actual results:

When an XMLHTTP or XHR request from attacker.com to victim.com Mozilla append the cookies of victim.com to the server. Response comes back to attacker.com. 


Expected results:

TO prevent one website stealing cookies of another, it is important to prevent these sensitive information while firing a cross origin XHR request. When you test the same file in Chrome or IE you can see the difference as they dont send these cookie information along with the request.

Comment 1

[Al Billings [:abillings - ex-MoCo]]

Please log security related bugs as security sensitive, not as public issues.

Comment 2

[Andrew McCreight [:mccr8]]

Attachment: SOP violation, plain text

This is the same content as the doc file, except as plain text.

Comment 3

[Andrew McCreight [:mccr8]]

Could you look at this, Andrea? The test case uses XHR. Thanks.

Comment 4

[Andrea Marchesini [:baku]]

We send cookies for the XHR target as the spec says.
I also tested this with chrome and it does exactly the same as its network devtool panel shows.

I'm curios to know how the attacker.com can retrieve the cookies sent to the victim.com.
Can you provide a full test case where the attacker page can read the cookies?

Comment 5

[Daniel Veditz [:dveditz]]

In a normal web GET request, for example an <IMG> tag, cookies are always sent. Therefore XHR/Fetch can send cookies on a GET request without introducing new problems. CORS comes into play when you want to read the response, but the cookies are sent unless you ask them not to be (either way you need CORS to read the response, but whether credentials are sent affects which CORS responses are required).