Apache Shiro: Shiro's native session and rememberMe cookies do not have secure flag set by default

Vulnerability

Apache Shiro's native session manager and Remember-Me manager send JSESSIONID and rememberMe cookies without the Secure attribute by default. This affects versions 1.0 to 2.1.0 and 3.0.0-alpha-1 [1]. The Secure attribute ensures cookies are only transmitted over HTTPS, but it is missing in these configurations.

Exploitation

An attacker with network access (e.g., on a shared Wi-Fi or via man-in-the-middle) can intercept the unencrypted cookie if the connection is downgraded or if the user accesses a non-HTTPS page. No authentication is required; the attacker simply needs to capture the cookie during transmission.

Impact

Successful exploitation allows the attacker to hijack the user's session or remember-me token, leading to unauthorized access to the application as the victim. This compromises confidentiality and integrity of user data and actions.

Mitigation

Upgrade to Apache Shiro 2.1.1 or 3.0.0-alpha-2 or later, which include the Secure attribute by default [1]. Alternatively, manually configure the Secure attribute on cookies in the application's configuration. No other workarounds are mentioned in the available references.