Description

All versions of daloRADIUS prior to the master branch transmit the session cookie (i.e. PHPSESSID) without setting the HttpOnly flag.

Proof of Concept

$ curl --head http://<hostname>/login.php
HTTP/1.1 200 OK
Date: Tue, 20 Dec 2022 14:11:38 GMT
Server: Apache
Set-Cookie: PHPSESSID=djogjur0vjgg0hd9jkdc27p2h1; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Type: text/html; charset=UTF-8

Impact

The problem could cause JavaScript (e.g., using document.cookies) to access the PHPSESSID cookie value on the browser side.

Fix

To prevent JavaScript from being able to access the cookie value, the cookie must be transmitted with the HttpOnly flag set.