Cookie Without HTTPOnly Secure Flag Set (CVE‐2024‐36788) - Redfox-Security/Security-Advisory-Multiple-Vulnerabilities-in-Netgear-WNR614-Router GitHub Wiki

Description:

Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 does not properly set the HTTPOnly flag for cookies. This allows attackers to possibly intercept and access sensitive communications between the router and connected devices.

Impact:

The Netgear WNR614 router’s improper “HTTPOnly” cookie flag setting exposes critical data to potential interception, posing a substantial risk of unauthorized network access and compromise.

Mitigation:

  • Manually configure the router to use HTTPS for all communications.
  • Use browser security features and extensions that enforce HTTPS connections.

POC:

Due to not setting the “HTTPOnly” flag, this vulnerability risks sensitive data exposure through unencrypted channels, enabling attackers to potentially hijack sessions and compromise the network.

image Figure: Cookie Without HTTPOnly Flag Set

image Figure: Cookie Without Secure Flag Set