Identifying a PHPSESSID Cookie Security Misconfiguration on acr.iitbombay.org

About Me

Hello everyone!

I'm Praveen Rathod (Radhe_Karn), an independent security researcher passionate about cybersecurity, ethical hacking, web application security, and vulnerability research.

I believe that cybersecurity is not always about finding critical vulnerabilities. Sometimes, identifying small security misconfigurations and reporting them responsibly can make a meaningful difference.

In this article, I am sharing a security finding identified during an assessment of acr.iitbombay.org.

1. Security Finding

Vulnerability: PHPSESSID Cookie Missing HttpOnly Attribute

During the assessment, I inspected the server's HTTP response headers and identified that the PHP session cookie was missing the HttpOnly security attribute.

2. Before — Observed Configuration

http

Set-Cookie: PHPSESSID=[REDACTED]; path=/

Set-Cookie: PHPSESSID=[REDACTED]; path=/

Observation: The HttpOnly attribute was missing.

This configuration may allow client-side JavaScript to access the session cookie, potentially increasing session exposure if malicious JavaScript executes within the affected origin.

3. After — Recommended Secure Configuration

The following configuration is recommended:

http

Set-Cookie: PHPSESSID=[REDACTED]; Path=/; HttpOnly; Secure; SameSite=Lax

Set-Cookie: PHPSESSID=[REDACTED]; Path=/; HttpOnly; Secure; SameSite=Lax

Security improvements:

• HttpOnly – Prevents JavaScript access to the cookie.
• Secure – Restricts cookie transmission to HTTPS.
• SameSite=Lax – Provides additional protection against certain cross-site request risks.

4. Vulnerability Details

ParameterDetailsTargetacr.iitbombay.orgAffected CookiePHPSESSIDVulnerabilityMissing HttpOnly AttributeCWECWE-1004SeverityLow

5. Responsible Disclosure

After identifying the issue, I prepared a technical report containing the affected URL, HTTP response evidence, potential impact, and remediation recommendations.

The finding was responsibly reported to the concerned security/IT team for review.

No XSS exploitation, session hijacking, or unauthorized access was attempted.

6. Conclusion

This finding highlights the importance of properly configuring session cookies to strengthen web application security.

Even a small security misconfiguration deserves attention when it can be addressed through responsible disclosure.

My approach to security research: Identify. Analyze. Document. Report Responsibly.

About the Author

Praveen Rathod (Radhe_Karn) Independent Security Researcher