Missing HtppOnly and Secure flags

Vulnerability

The vulnerability resides in the session cookie handling of Secomea GateManager. When the 'Secure' attribute is missing on cookies transmitted over HTTPS, the cookie can be sent over unencrypted HTTP connections. This affects all versions of GateManager prior to 9.3 [1]. The cookie is transmitted without the Secure flag, making it possible to leak the cookie when an HTTPS page loads resources over HTTP.

Exploitation

An attacker positioned on the network (e.g., via man-in-the-middle attack) can intercept HTTP traffic or trick the user into visiting a non-HTTPS page that triggers the insecure cookie transmission. No authentication is required; the attacker only needs to observe network traffic or perform a downgrade attack.

Impact

Successful exploitation allows the attacker to capture session cookies, potentially leading to session hijacking and unauthorized access to the GateManager web interface with the victim's privileges. This could result in disclosure of sensitive configuration data or control over managed devices.

Mitigation

Secomea has addressed the issue in GateManager version 9.3 [1]. Users should upgrade to 9.3 or later immediately. No workarounds are documented; upgrading is the only recommended mitigation.