312-50 Question 297
Single answer▪ Web App ConceptsDuring an authorized web application assessment, you are testing an online banking portal. After authenticating as a normal user, you notice that the application stores a session cookie named SESSIONID. When you log out, the browser still retains the cookie, and the application only invalidates it on the server side after several minutes. You also observe that the cookie is missing the HttpOnly attribute, but it is marked Secure. The client asks which issue presents the most direct risk if the application also contains a reflected cross-site scripting (XSS) flaw on an authenticated page. Which finding should you prioritize as the most critical combination of weaknesses?
- A
The missing HttpOnly attribute, because reflected XSS could allow JavaScript to read the session cookie and facilitate session hijacking
- B
The Secure attribute, because it prevents the cookie from being sent over HTTP and therefore makes XSS exploitation easier
- C
The delayed server-side session invalidation, because it alone allows attackers to execute arbitrary JavaScript in the victim's browser
- D
The fact that the cookie persists in the browser after logout, because any persistent cookie automatically results in SQL injection
Show answer and explanation
Correct answer: A
Explanation
The best answer is Option 1 because it identifies the most direct and practical exploitation path in the scenario: reflected XSS on an authenticated page plus a session cookie lacking HttpOnly can enable theft of the session token. In CEH-style web app concepts, candidates should distinguish between cookie security attributes and understand their specific roles. Secure protects confidentiality of cookies in transit by restricting them to HTTPS, while HttpOnly helps protect against client-side script access. If XSS exists, missing HttpOnly materially increases the impact because the browser may expose the cookie to malicious JavaScript. Delayed logout invalidation is also relevant to session management and should be reported, but it is not the primary enabler of script-based cookie theft in this scenario. This aligns with OWASP guidance on session management and XSS prevention, which emphasizes using HttpOnly and Secure flags, proper session invalidation, and eliminating XSS vulnerabilities through output encoding, input handling, and contextual defenses.
- A. Correct.
Correct. HttpOnly is intended to reduce the risk of client-side scripts accessing session cookies. If an authenticated page is vulnerable to reflected XSS and the session cookie is not marked HttpOnly, injected JavaScript may be able to read the SESSIONID value and exfiltrate it to an attacker, enabling session hijacking. In a banking context, this is a high-priority finding because it combines a session management weakness with a client-side injection flaw.
- B. Incorrect.
Incorrect. The Secure attribute is a protective control, not a weakness. It ensures the browser only sends the cookie over HTTPS, helping mitigate interception over unencrypted transport. It does not make XSS easier. A common misconception is to confuse transport-layer protections with client-side script protections; Secure does not stop JavaScript access to the cookie.
- C. Incorrect.
Incorrect. Delayed server-side invalidation is a session management concern because a session may remain valid for a short period after logout, but by itself it does not allow arbitrary JavaScript execution. Arbitrary JavaScript execution is caused by XSS, not by slow session invalidation. This option mixes two different classes of issues.
- D. Incorrect.
Incorrect. Cookie persistence after logout can be a security concern depending on how the application manages logout and browser-side state, but it does not automatically lead to SQL injection. SQL injection is related to unsafe handling of database queries, not cookie persistence. This distractor targets candidates who confuse unrelated web application vulnerabilities.