Description

Detects session cookies that are configured without an explicit path attribute. When the path attribute is undefined, the cookie becomes accessible from any path on the domain, potentially allowing unauthorized access to session cookies from different applications or subdomains hosted on the same domain.

Detection Strategy

• Look for session cookie configurations in the application code

• Check if these cookie configurations lack a 'path' attribute setting

• Report a vulnerability for each session cookie where the path attribute is not explicitly defined

Vulnerable code example

import express from 'express';
import session from 'express-session';

const app = express();

// VULNERABLE: Hardcoded session secret makes the session potentially predictable
app.use(session({
  secret: 'mysecret',...

✅ Secure code example

import express from 'express';
import session from 'express-session';
import crypto from 'crypto';

const app = express();
app.set('trust proxy', 1); // Enable if behind a proxy

// Generate random secret or use environment variable...