Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-25091

CVE-2019-25091: nsupdate.info has Sensitive Cookie Without 'HttpOnly' Flag

5.3

CVSS Score
3.1

Basic Information

CVE ID
CVE-2019-25091
GHSA ID
GHSA-mwvp-qr62-cvjx
EPSS Score
0.22577%
CWE
CWE-1004
Published
12/28/2022
Updated
2/2/2023
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
nsupdatepip<= 0.12.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the Django configuration setting CSRF_COOKIE_HTTPONLY being disabled (False) in base.py. The commit 60a3fe5 explicitly changes this value from False to True to fix the issue. While not a traditional function, this configuration parameter directly controls the HttpOnly flag behavior for the CSRF cookie, making it the root cause. The GitHub PR #410 and commit diff confirm this was the vulnerable point.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility *l*ssi*i** *s pro*l*m*ti* **s ***n *oun* in nsup**t*.in*o. T*is *****ts *n unknown p*rt o* t** *il* `sr*/nsup**t*/s*ttin*s/**s*.py` o* t** *ompon*nt `*SR* *ooki* **n*l*r`. T** m*nipul*tion o* t** *r*um*nt `*SR*_*OOKI*_*TTPONLY` l***s

Reasoning

T** vuln*r**ility st*ms *rom t** *j*n*o *on*i*ur*tion s*ttin* *SR*_*OOKI*_*TTPONLY **in* *is**l** (**ls*) in **s*.py. T** *ommit ******* *xpli*itly ***n**s t*is v*lu* *rom **ls* to Tru* to *ix t** issu*. W*il* not * tr**ition*l *un*tion, t*is *on*i*u