Need a new VRT entry for session token transferred over unencrypted channel (for non-cookie headers)

[TheGarth]

Right now we have an entry for "Server Security Misconfiguration" > "Missing Secure or HTTPOnly Cookie Flag" > "Session Token", at a P4. But (from what I can tell), we do not have anything equivalent for tokens submitted via other headers, and the previously mentioned VRT does not seem like an appropriate fit.

I propose something along the lines of a "Server Security Misconfiguration" > "Session Token Transferred Over Unencrypted Channel", at a default P4.

[SwayzeSlacks85]

+1 for adding this entry. Is the mitigation the same in both cases? Adding the secure flag? I've run into confusion on this issue in several submissions.

[jquinard]

Should this be changed to "Sensitive Token" instead of "Session Token"?

[jstnkndy]

Perhaps there should just be one generic entry for sensitive information transmitted over an unencrypted channel, rather than having multiple VRT entries.

[plr0man]

@jstnkndy we do have one: "Varies" –> Insecure Data Transport -> Cleartext Transmission of Sensitive Data. It's a catch all entry for anything from CC# to email address etc. On the other hand we try to address types of issues that are common enough and qualify for a severity rating baseline.

@jquinard in case of "sensitive" I would rely on the above mentioned entry

@SwayzeSlacks85 in case of session tokens sent in custom headers (non-cookie) the secure cookie flag is not an option and there's no explicit entry that we offer right now. In case of session cookies on the other hand, the secure flag will prevent the cookie from being sent over unencrypted channel

Potential classification here could be:
P4 -> Broken Authentication and Session Management -> Cleartext Transmission of Session Token

[jquinard]

@plr0man I didn't see that one. +1 to your proposed entry.

[kongwenbin]

+1 to @plr0man's suggested potential classification naming.