(tooling-agents) branch main updated: ASVS L3 audit: 3.3.3 (ch03_general)

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asf-tooling pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-agents.git


The following commit(s) were added to refs/heads/main by this push:
     new e66cf43  ASVS L3 audit: 3.3.3 (ch03_general)
e66cf43 is described below

commit e66cf43f9e68d4ce5bfc5535116770318df9ea1c
Author: ASF Tooling Team <ro...@apache.org>
AuthorDate: Wed Apr 22 11:49:53 2026 +0200

    ASVS L3 audit: 3.3.3 (ch03_general)
---
 .../reports/steve/v3/d0aa7e9/ch03_general/3.3.3.md | 217 +++++++++++++++++++++
 1 file changed, 217 insertions(+)

diff --git a/repos/apache/ASVS/reports/steve/v3/d0aa7e9/ch03_general/3.3.3.md b/repos/apache/ASVS/reports/steve/v3/d0aa7e9/ch03_general/3.3.3.md
new file mode 100644
index 0000000..87072c0
--- /dev/null
+++ b/repos/apache/ASVS/reports/steve/v3/d0aa7e9/ch03_general/3.3.3.md
@@ -0,0 +1,217 @@
+# ASVS 3.3.3 Security Audit Report
+
+## Executive Summary
+
+**Audit Metadata:**
+- **Repository:** apache/steve
+- **Audit Date:** Apr 22, 2026
+- **Auditor:** Tooling Agents
+- **ASVS Requirement:** 3.3.3 — Verify that cookies have the '__Host-' prefix for the cookie name unless they are explicitly designed to be shared with other hosts.
+  - **Level:** 2
+  - **Section:** Cookie Setup
+  - **Section Description:** This section outlines requirements for securely configuring sensitive cookies to provide a higher level of assurance that they were created by the application itself and to prevent their contents from leaking or being inappropriately modified.
+  - **Chapter:** Web Frontend Security
+  - **Control Objective:** This category focuses on requirements designed to protect against attacks executed via a web frontend. These requirements do not apply to machine-to-machine solutions.
+
+**Scope:**
+- Files analyzed: 4 relevant out of 49 total, 12 skipped
+
+**Finding Counts:**
+
+| Severity | Count |
+|----------|-------|
+| Critical | 0 |
+| High | 0 |
+| Medium | 1 |
+| Low | 0 |
+| **Total** | **1** |
+
+**Summary:**
+
+The application does not configure its session cookie (or any other cookies) to use the `__Host-` prefix as required by ASVS 3.3.3. The session management is handled by the `asfquart` framework wrapper around Quart, and no visible configuration overrides the default cookie naming to include the `__Host-` prefix.
+
+---
+
+## Security Controls Inventory
+
+| Control | Defined Location | Applied To | Coverage |
+|---------|-----------------|------------|----------|
+| Session Cookie Name | Not configured in provided code | N/A | **MISSING** |
+| `__Host-` prefix | Not found anywhere in codebase | N/A | **MISSING** |
+| Secure cookie attribute | Implied by TLS config in `main.py:89-92` but not explicitly verified | Session cookie | **UNKNOWN** |
+| Cookie Domain restriction | Not configured in provided code | N/A | **UNKNOWN** |
+
+### Cookie-Setting Entry Points
+
+| Entry Point | Cookie Type | `__Host-` Prefix | Notes |
+|-------------|------------|-------------------|-------|
+| `asfquart.session` (session creation on login) | Session cookie | ❌ Not applied | Default Quart session cookie name used |
+| `quart.flash()` via `flash_*` helpers (lines 111-118) | Stored in session cookie | ❌ Not applied | Inherits session cookie name |
+
+---
+
+## Critical File Review
+
+### `v3/server/main.py`
+
+| Line(s) | Content | Cookie Security Relevance |
+|---------|---------|--------------------------|
+| 38-41 | OAuth URL configuration | OAuth callback may set cookies; no `__Host-` visible |
+| 44 | `asfquart.construct('steve', ...)` | App factory — no cookie configuration parameters |
+| 86-92 | TLS certificate configuration | Enables HTTPS (prerequisite for `Secure` cookies) but doesn't set cookie attributes |
+
+### `v3/server/pages.py`
+
+| Line(s) | Content | Cookie Security Relevance |
+|---------|---------|--------------------------|
+| 70 | `asfquart.session.read()` | Reads session cookie — name controlled by framework default |
+| 75 | `basic.csrf_token = 'placeholder'` | CSRF token placeholder; if implemented as a cookie, would also need `__Host-` prefix |
+| 111-118 | `flash_*` helpers | Flash messages stored in session; inherit session cookie configuration |
+
+---
+
+## Findings
+
+### Medium Severity
+
+#### ASVS-333-SEV-001: Session Cookie Missing `__Host-` Prefix
+
+**Severity:** MEDIUM  
+**Gap Type:** Type A — No control exists  
+**Location:** `v3/server/main.py`, lines 44-46  
+**Related Functions:** `v3/server/pages.py`, line 70 (`asfquart.session.read()`)
+
+**Description:**
+
+The application does not configure the session cookie with the `__Host-` prefix as required by ASVS 3.3.3. The session cookie carries authentication state (user ID, name, email) and is read on every authenticated page load via `basic_info()`. Without the `__Host-` prefix, the cookie is vulnerable to subdomain injection attacks.
+
+**Vulnerable Code:**
+
+App Construction (`main.py:44-46`):
+```python
+app = asfquart.construct('steve', app_dir=THIS_DIR, static_folder=None)
+```
+
+No session cookie name configuration is provided. Quart's default session cookie name is `session`, which lacks the `__Host-` prefix.
+
+Session Usage (`pages.py:70-76`):
+```python
+s = await asfquart.session.read()
+if s:
+    basic.update(
+        uid=s['uid'],
+        name=s['fullname'],
+        email=s['email'],
+    )
+```
+
+**Data Flow:**
+
+```
+Login (asfquart OAuth) → Session cookie set (name: "session") → Cookie sent on every request → basic_info() reads session → User identity established
+```
+
+**Impact:**
+
+On the `apache.org` domain (which hosts this application per the OAuth configuration), the absence of `__Host-` prefix means:
+
+1. **Subdomain cookie injection**: A compromised or attacker-controlled subdomain (e.g., `evil.apache.org`) could set a cookie named `session` for the parent domain, overriding the legitimate session cookie and performing session fixation.
+2. **No browser-enforced binding**: Without `__Host-`, the browser does not enforce that the cookie was set with `Secure`, without a `Domain` attribute, and with `Path=/`. These constraints must be manually configured and maintained.
+3. **Cookie tossing**: An attacker on any `*.apache.org` subdomain could "toss" a session cookie to the voting application, potentially hijacking sessions for an election system handling sensitive voting data.
+
+**Proof of Concept:**
+
+An attacker controlling any subdomain of `apache.org` could inject:
+```
+Set-Cookie: session=attacker-controlled-value; Domain=.apache.org; Path=/
+```
+
+This would override the legitimate session cookie in the victim's browser when visiting the STeVe application.
+
+**Remediation:**
+
+Configure the session cookie name to use the `__Host-` prefix in the Quart/asfquart application configuration:
+
+```python
+def create_app():
+    app = asfquart.construct('steve', app_dir=THIS_DIR, static_folder=None)
+
+    # Configure session cookie with __Host- prefix per ASVS 3.3.3
+    app.config['SESSION_COOKIE_NAME'] = '__Host-session'
+    app.config['SESSION_COOKIE_SECURE'] = True      # Required for __Host- prefix
+    app.config['SESSION_COOKIE_HTTPONLY'] = True      # Defense in depth
+    app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'    # CSRF mitigation
+    app.config['SESSION_COOKIE_PATH'] = '/'           # Required for __Host- prefix
+    # Do NOT set SESSION_COOKIE_DOMAIN — __Host- prefix requires no Domain attribute
+
+    import pages
+    import api
+
+    return app
+```
+
+If `asfquart` wraps cookie configuration differently, the equivalent configuration should be applied through its API. The key requirements for `__Host-` prefixed cookies are:
+- `Secure` flag must be set
+- `Path` must be `/`
+- `Domain` attribute must **not** be set
+
+---
+
+## Positive Security Patterns
+
+| Pattern | Location | Notes |
+|---------|----------|-------|
+| TLS enforcement | `main.py:89-92` | Certificate configuration supports `Secure` cookies |
+| Session-based auth | `pages.py:70` | Session data not exposed in URL parameters |
+| External auth (OAuth) | `main.py:38-41` | Authentication delegated to ASF OAuth, reducing local cookie attack surface |
+| Auth decorators on all sensitive routes | Throughout `pages.py` | Consistent authentication enforcement |
+| `send_from_directory()` for static files | `pages.py:648,655,660` | Avoids setting application cookies on static resource paths |
+
+---
+
+## Architecture Observations
+
+1. **Cookie management is fully delegated to framework**: The application relies entirely on `asfquart`/Quart for cookie handling. No explicit `set_cookie()` calls exist in application code, meaning the fix must be applied at the framework configuration level.
+
+2. **Shared domain risk**: The application runs on `apache.org` infrastructure (per OAuth URLs), which hosts hundreds of services on subdomains. This amplifies the risk of subdomain cookie injection attacks.
+
+3. **Single cookie dependency**: All authenticated state flows through a single session cookie (read in `basic_info()` which is called by every authenticated handler). Compromising this cookie compromises the entire user session.
+
+4. **CSRF token gap compounds risk**: The placeholder CSRF token (`pages.py:75`) means that if session fixation succeeds via cookie injection, there is no secondary defense against cross-site request forgery on state-changing operations.
+
+---
+
+## Recommendations Summary
+
+### Immediate Actions (Priority 1)
+
+| Recommendation | Effort | Impact |
+|---------------|--------|--------|
+| Configure session cookie with `__Host-` prefix via `SESSION_COOKIE_NAME = '__Host-session'` | Low | Prevents subdomain cookie injection/session fixation |
+| Explicitly set `SESSION_COOKIE_SECURE = True`, `SESSION_COOKIE_HTTPONLY = True`, `SESSION_COOKIE_SAMESITE = 'Lax'` | Low | Defense in depth; required attributes for `__Host-` prefix |
+
+### Short-term Actions (Priority 2)
+
+| Recommendation | Effort | Impact |
+|---------------|--------|--------|
+| Verify `asfquart` framework does not override cookie configuration or set its own cookies without `__Host-` prefix | Medium | Ensure no framework-level cookies bypass the configuration |
+
+### Long-term Actions (Priority 3)
+
+| Recommendation | Effort | Impact |
+|---------------|--------|--------|
+| If CSRF tokens are implemented as separate cookies in the future, ensure they also use `__Host-` prefix | Low | Consistent cookie security across all application cookies |
+
+---
+
+## Appendix: Files Analyzed
+
+<details>
+<summary>Click to expand file list (4 files)</summary>
+
+1. `v3/server/pages.py` (relevance: 10)
+2. `v3/server/main.py` (relevance: 8)
+3. `v3/ARCHITECTURE.md` (relevance: 3)
+4. `v3/docs/quickstart.md` (relevance: 2)
+
+</details>
\ No newline at end of file


---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org