Session Cookie without Secure and HTTPOnly flags in taipy

Vulnerability

Overview

CVE-2024-47833 affects the Taipy open-source Python library, which is used by data scientists and machine learning engineers to build web applications. In affected versions, session cookies are served without the Secure and HTTPOnly flags [1]. The Secure flag ensures cookies are only transmitted over HTTPS, while the HTTPOnly flag prevents client-side scripts from accessing the cookie. The absence of these flags weakens the security of session management.

Exploitation

Prerequisites

An attacker can exploit this vulnerability through cross-site scripting (XSS) or man-in-the-middle (MITM) attacks. Without the HTTPOnly flag, a malicious script injected into the application can read the session cookie. Without the Secure flag, the cookie may be transmitted over unencrypted HTTP connections, allowing network-level interception [4]. The attack requires the attacker to either inject a script or be positioned on the network path between the user and the server.

Impact

Successful exploitation allows an attacker to steal a user's session cookie and impersonate that user, gaining unauthorized access to the application and its data. This can lead to data breaches, privilege escalation, and other malicious actions within the context of the compromised session.

Mitigation

The issue has been addressed in Taipy release version 4.0.0 [1]. All users are advised to upgrade to this version or later. There are no known workarounds for this vulnerability.