Apache Shiro Cookie Vulnerability: Missing Secure Attribute in HTTPS Sessions

A vulnerability exists in default configurations of Apache Shiro, where sensitive cookies are sent over HTTPS without the 'Secure' attribute. This issue affects versions 1.0 to 2.1.0, as well as 3.0.0-alpha-1. In these versions, the Shiro-native session manager and the Remember-Me manager transmit JSESSIONID and rememberMe cookies without the 'Secure' attribute by default.

Impact

The absence of the 'Secure' attribute allows cookies to be transmitted over unencrypted channels, increasing the risk of interception by attackers.

Remediation

Users are advised to upgrade to Apache Shiro version 2.1.1 or 3.0.0-alpha-2 or later, both of which address this vulnerability by including the 'Secure' attribute in cookies. Instructions for upgrading can be found in the Apache Shiro documentation.