Fix insecure session cookie tampering by signing cookies with a secret key using SHA256.

[zeropath-ai]

Summary

• The Vulnerability Description:
  The application’s session cookie is vulnerable to tampering because the permission level is stored as plaintext JSON and “signed” only with a bare SHA256 hash. Attackers could alter the cookie, recalculate the SHA256 hash, and forge elevated privileges, since SHA256 alone does not provide protection against such manipulation.

• This Fix:
  The fix introduces a SECRET_KEY (pulled from environment variables) and includes it as part of the input to the SHA256 hash when signing the session cookie, preventing attackers from recalculating valid hashes even if they tamper with the cookie.

• The Cause of the Issue:
  The root problem is the use of a predictable, unhashed session format and a raw SHA256 hash for signing, allowing attackers to re-sign tampered data without knowing any secret.

• The Patch Implementation:
  All locations where the SHA256 hash is computed now append a secret key (SECRET_KEY) to the input before hashing, binding the hash to the server-side secret and stopping unauthorized tampering with the session cookie.

Vulnerability Details

• Vulnerability Class: Missing Authentication
• Severity: 10.0
• Affected File: owasp-top10-2021-apps/a7/saidajaula-monster/app/app.py
• Vulnerable Lines: 105-111

Code Snippets

diff --git a/owasp-top10-2021-apps/a7/saidajaula-monster/app/app.py b/owasp-top10-2021-apps/a7/saidajaula-monster/app/app.py
index 59267802..202aaa1d 100644
--- a/owasp-top10-2021-apps/a7/saidajaula-monster/app/app.py
+++ b/owasp-top10-2021-apps/a7/saidajaula-monster/app/app.py
@@ -12,6 +12,7 @@ from functools import wraps
 
 
 app = Flask(__name__)
+SECRET_KEY = os.environ.get('SESSION_SECRET', '')
 database = DataBase(os.environ.get('A2_DATABASE_HOST'),
                     os.environ.get('A2_DATABASE_USER'),
                     os.environ.get('A2_DATABASE_PASSWORD'),
@@ -26,7 +27,7 @@ def login_admin_required(f):
         cookie_separado = cookie.split('.')
         if(len(cookie_separado) != 2):
             return "Invalid cookie!"
-        hash_cookie = hashlib.sha256(cookie_separado[0].encode('utf-8')).hexdigest()
+        hash_cookie = hashlib.sha256((cookie_separado[0] + SECRET_KEY).encode('utf-8')).hexdigest()
         if (hash_cookie != cookie_separado[1]):
             return redirect("/login")
         j = json.loads(cookie_separado[0])
@@ -44,7 +45,7 @@ def login_required(f):
         cookie_separado = cookie.split('.')
         if(len(cookie_separado) != 2):
             return "Invalid cookie! \n"
-        hash_cookie = hashlib.sha256(cookie_separado[0].encode('utf-8')).hexdigest()
+        hash_cookie = hashlib.sha256((cookie_separado[0] + SECRET_KEY).encode('utf-8')).hexdigest()
         if (hash_cookie != cookie_separado[1]):
             return redirect("/login")
         return f(*args, **kwargs)
@@ -104,7 +105,7 @@ def login():
 
         cookie_dic = {"permissao": result[1], "username": form_username}
         cookie = json.dumps(cookie_dic)
-        hash_cookie = hashlib.sha256(cookie.encode('utf-8')).hexdigest()
+        hash_cookie = hashlib.sha256((cookie + SECRET_KEY).encode('utf-8')).hexdigest()
         cookie_done = '.'.join([cookie,hash_cookie])
         cookie_done = base64.b64encode(str(cookie_done).encode("utf-8"))
         resp = make_response("Logged in!")

How to Modify the Patch

You can modify this patch by using one of the two methods outlined below. We recommend using the @zeropath-ai bot for updating the code. If you encounter any bugs or issues with the patch, please report them here.

Ask @zeropath-ai!

To request modifications, please post a comment beginning with @zeropath-ai and specify the changes required.

@zeropath-ai will then implement the requested adjustments and commit them to the specified branch in this pull request. Our bot is capable of managing changes across multiple files and various development-related requests.

Manually Modify the Files

# Checkout created branch:
git checkout zvuln_fix_missing_authentication_1751928063067810

# if vscode is installed run (or use your favorite editor / IDE):
code owasp-top10-2021-apps/a7/saidajaula-monster/app/app.py

# Add, commit, and push changes:
git add -A
git commit -m "Update generated patch with x, y, and z changes."
git push zvuln_fix_missing_authentication_1751928063067810