You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Add correlatable field for SAST-correlated vulnerabilities
Mark 48 DAST vulnerability definitions with correlatable: SAST to
indicate they can be correlated with SAST findings. This supports the
new correlatable column on the vulnerabilities site.
ISO 27001: A.5.33, A.5.34, A.8.4, A.8.9, A.8.12, A.8.15, A.8.25
@@ -14,28 +15,28 @@ compliance:
14
15
15
16
---
16
17
17
-
The ASP.NET debug feature is useful for debugging ASP.NET web applications, and even be used for remote debugging. This feature can reveal sensitive information about the internals of the application, such as code snippets, environment variables, security keys, etc. All of this can be used by an attacker to increase the likelihood of an successful attack.
18
-
18
+
The ASP.NET debug feature is useful for debugging ASP.NET web applications, and even be used for remote debugging. This feature can reveal sensitive information about the internals of the application, such as code snippets, environment variables, security keys, etc. All of this can be used by an attacker to increase the likelihood of an successful attack.
19
+
19
20
This debug feature should not be enabled in a production environment.
20
21
21
22
## How to fix
22
23
23
24
{% tabs aspnet-debugging-enabled %}
24
25
{% tab aspnet-debugging-enabled generic %}
25
-
ASP.NET debugging is a feature of the ASP.NET framework, configured in the `web.config` file. To disable it, you need to edit the `web.config` file and change the `debug` flag within your `compilation` directive to `false`:
26
-
27
-
```
28
-
<configuration>
29
-
<system.web>
30
-
<compilation
31
-
debug="false"
32
-
...
33
-
>
34
-
...
35
-
</compilation>
36
-
</system.web>
37
-
</configuration>
38
-
26
+
ASP.NET debugging is a feature of the ASP.NET framework, configured in the `web.config` file. To disable it, you need to edit the `web.config` file and change the `debug` flag within your `compilation` directive to `false`:
We identified one or more issues with your X509 server certificate, which are detailed further below.
18
-
19
-
This finding usually means that the certificate was emitted with insecure attributes. Common examples include:
20
-
21
-
* Using 1024-bit RSA keys;
22
-
* Using the MD5 hashing algorithm for digital signatures;
18
+
We identified one or more issues with your X509 server certificate, which are detailed further below.
19
+
20
+
This finding usually means that the certificate was emitted with insecure attributes. Common examples include:
21
+
22
+
* Using 1024-bit RSA keys;
23
+
* Using the MD5 hashing algorithm for digital signatures;
23
24
* Having an invalid `keyUsage` attribute. For example, using a certificate whose purpose does not allow it to be used for Digital Signature or Key Agreement.
Please replace your X509 certificate as soon as possible. Use a certificate from a Certification Authority trusted by modern browsers, which should guarantee it fulfills all security requirements. If you are unsure about choosing a Certificate Authority, we recommend [Let's Encrypt](https://letsencrypt.org/). Let's Encrypt provides modern X509 certificates at no cost.
30
-
31
-
If you are using an internal Certificate Authority, or are using self-signed certificates, please ensure that the following requirements are met:
32
-
33
-
* Use RSA certificates with, at least, 2048-bit key size, or EC certificates with, at least, 256-bit key size;
34
-
* Ensure that a strong hash function is used in the certificate digital signature, such as SHA-256;
30
+
Please replace your X509 certificate as soon as possible. Use a certificate from a Certification Authority trusted by modern browsers, which should guarantee it fulfills all security requirements. If you are unsure about choosing a Certificate Authority, we recommend [Let's Encrypt](https://letsencrypt.org/). Let's Encrypt provides modern X509 certificates at no cost.
31
+
32
+
If you are using an internal Certificate Authority, or are using self-signed certificates, please ensure that the following requirements are met:
33
+
34
+
* Use RSA certificates with, at least, 2048-bit key size, or EC certificates with, at least, 256-bit key size;
35
+
* Ensure that a strong hash function is used in the certificate digital signature, such as SHA-256;
35
36
* Ensure that the `keyUsage` attribute has the required flags: Digital Signature and Key Agreement.
Not having the HttpOnly flag means that the cookie can be accessed by client side scripts, such as JavaScript. This vulnerability by itself is not useful to an attacker since he has no control over client side scripts. However, if a Cross Site Scripting (XSS) vulnerability is present, he might be able to introduce a malicious script in the application, and without the HttpOnly flag, he could read the vulnerable cookie's value.
18
-
19
-
The most interesting cookie for an attacker is usually the session cookie as it allows him to steal the user's session. Other cookies might be interesting also, depending on the application and the cookie's purposes, so a good rule-of-thumb is to set HttpOnly flag to all cookies.
20
-
18
+
Not having the HttpOnly flag means that the cookie can be accessed by client side scripts, such as JavaScript. This vulnerability by itself is not useful to an attacker since he has no control over client side scripts. However, if a Cross Site Scripting (XSS) vulnerability is present, he might be able to introduce a malicious script in the application, and without the HttpOnly flag, he could read the vulnerable cookie's value.
19
+
20
+
The most interesting cookie for an attacker is usually the session cookie as it allows him to steal the user's session. Other cookies might be interesting also, depending on the application and the cookie's purposes, so a good rule-of-thumb is to set HttpOnly flag to all cookies.
21
+
21
22
Mitigating this kind of vulnerability greatly reduces the impact of other possible vulnerabilities, such as XSS, which are very common in most sites.
22
23
23
24
## How to fix
24
25
25
26
{% tabs cookie-without-httponly-flag %}
26
27
{% tab cookie-without-httponly-flag generic %}
27
-
To fix a vulnerability of this type, you just need to set the HttpOnly flag on the vulnerable cookie, effectively preventing it from being read by client side scripts.
28
-
28
+
To fix a vulnerability of this type, you just need to set the HttpOnly flag on the vulnerable cookie, effectively preventing it from being read by client side scripts.
29
+
29
30
Depending on the language and technologies you are using, setting the HttpOnly flag could mean to enable it or setting it to true, either on the code of the application itself or in a configuration file of the webserver or Content Management System (CMS) you are using.
cwe-name: Improper Neutralization of CRLF Sequences ('CRLF Injection')
8
+
correlatable: SAST
8
9
compliance:
9
10
HIPAA: 164.306(a)
10
11
ISO 27001: A.5.33, A.5.34, A.8.3, A.8.12
@@ -14,19 +15,19 @@ compliance:
14
15
15
16
---
16
17
17
-
A CRLF injection vulnerability allows an attacker to inject a CR (Carriage Return: ASCII 13, \r) and a LF (Line Feed: ASCII 10, \n) in user inputs, which are then inserted in the response to terminate lines and divide the header from the body in HTTP responses, in an unexpected manner.
18
-
18
+
A CRLF injection vulnerability allows an attacker to inject a CR (Carriage Return: ASCII 13, \r) and a LF (Line Feed: ASCII 10, \n) in user inputs, which are then inserted in the response to terminate lines and divide the header from the body in HTTP responses, in an unexpected manner.
19
+
19
20
With a CRLF injection, an attacker takes control of the response body to perpetrate the attack. For example, the CRLF might allow the attacker to do an XSS (cross-site scripting) attack by removing the CSP (content security policy) protection and injecting malicious JavaScript into the body.
20
21
21
22
## How to fix
22
23
23
24
{% tabs crlf-injection %}
24
25
{% tab crlf-injection generic %}
25
-
To prevent a CRLF injection vulnerability, you should:
26
-
27
-
* Not insert user input in the response headers.
28
-
* Use a library method that properly encodes header values.
29
-
26
+
To prevent a CRLF injection vulnerability, you should:
27
+
28
+
* Not insert user input in the response headers.
29
+
* Use a library method that properly encodes header values.
30
+
30
31
If your application needs to allow user input in a header, ensure the input only contains characters from a limited list, for instance, only alpha-numeric ones.
cwe-name: Use of a Broken or Risky Cryptographic Algorithm
8
+
correlatable: SAST
8
9
compliance:
9
10
HIPAA: 164.306(a), 164.312(c)(1), 164.312(e)(1)
10
11
ISO 27001: A.5.14, A.8.9, A.8.24
@@ -14,87 +15,87 @@ compliance:
14
15
15
16
---
16
17
17
-
TLS protocol version 1.0 is deprecated and is now considered insecure by security researchers and standards organizations alike. For example, the PCI (Payment Card Industry) Security Standards Council requires that TLS 1.0 is disabled starting from mid-2018.
18
-
19
-
This version has a design flaw in the way encryption Initialization Vectors (IVs) are handled, and security researchers devised an attack called BEAST that may allow an attacker to eavesdrop on connections using TLS 1.0.
20
-
However, note that TLS 1.0 is not immediately insecure, especially because BEAST is primarily a client-side attack, so if browsers are up-to-date, the connections should be safe.
21
-
22
-
In any case, the attacker needs to be able to eavesdrop and intercept the connection before being able to deliver the attack. This may be fairly common considering the frequency that clients establish connections over open Wi-Fi.
23
-
18
+
TLS protocol version 1.0 is deprecated and is now considered insecure by security researchers and standards organizations alike. For example, the PCI (Payment Card Industry) Security Standards Council requires that TLS 1.0 is disabled starting from mid-2018.
19
+
20
+
This version has a design flaw in the way encryption Initialization Vectors (IVs) are handled, and security researchers devised an attack called BEAST that may allow an attacker to eavesdrop on connections using TLS 1.0.
21
+
However, note that TLS 1.0 is not immediately insecure, especially because BEAST is primarily a client-side attack, so if browsers are up-to-date, the connections should be safe.
22
+
23
+
In any case, the attacker needs to be able to eavesdrop and intercept the connection before being able to deliver the attack. This may be fairly common considering the frequency that clients establish connections over open Wi-Fi.
24
+
24
25
If you'd like to know more about secure TLS deployments, we have written an extensive article about it [here](https://blog.probely.com/how-to-deploy-modern-tls-in-2018-1b9a9cafc454).
To fix this issue, you need to disable TLS 1.0. We also recommend that higher TLS protocol versions are enabled, ideally version 1.2 and above.
31
-
32
-
For most systems, enabling or disabling TLS versions requires a change on the web server configuration file. Therefore, refer to your web server documentation on how to do that.
33
-
34
-
If you are using Nginx, you may use the following snippet as a guideline:
35
-
36
-
```
37
-
server {
38
-
listen 443 ssl;
39
-
...
40
-
ssl_protocols TLSv1.2 TLSv1.3;
41
-
...
42
-
}
43
-
```
44
-
45
-
If using an Apache server, please refer to the following example:
46
-
47
-
```
48
-
<VirtualHost *:443>
49
-
...
50
-
SSLProtocol -all +TLSv1.2 +TLSv1.3
51
-
...
52
-
</VirtualHost>
53
-
```
54
-
55
-
Note that we are enabling TLS 1.2 and above, reflecting our ideal scenario.
56
-
31
+
To fix this issue, you need to disable TLS 1.0. We also recommend that higher TLS protocol versions are enabled, ideally version 1.2 and above.
32
+
33
+
For most systems, enabling or disabling TLS versions requires a change on the web server configuration file. Therefore, refer to your web server documentation on how to do that.
34
+
35
+
If you are using Nginx, you may use the following snippet as a guideline:
36
+
37
+
```
38
+
server {
39
+
listen 443 ssl;
40
+
...
41
+
ssl_protocols TLSv1.2 TLSv1.3;
42
+
...
43
+
}
44
+
```
45
+
46
+
If using an Apache server, please refer to the following example:
47
+
48
+
```
49
+
<VirtualHost *:443>
50
+
...
51
+
SSLProtocol -all +TLSv1.2 +TLSv1.3
52
+
...
53
+
</VirtualHost>
54
+
```
55
+
56
+
Note that we are enabling TLS 1.2 and above, reflecting our ideal scenario.
57
+
57
58
If you need to cater to clients with very old TLS support, such as ancient mobile devices, and know what you are doing, you can keep TLS 1.0 enabled, despite the known weaknesses. These issues are not as serious as the SSL protocol weaknesses, but you should weigh the need to support older clients with the risk of exposing private data. Moreover, keep in mind that TLS 1.2 support is well over [95%](https://blog.probely.com/how-to-deploy-modern-tls-in-2018-1b9a9cafc454).
To fix this issue you need to disable TLS 1.0. We also recommend that higher TLS protocol versions are enabled, ideally version 1.2 and above.
62
-
63
-
For most systems, enabling or disabling TLS versions requires a change on the web server configuration file. Therefore, refer to your web server documentation on how to do that.
64
-
65
-
For Nginx, you may use the following snippet as a guideline:
66
-
67
-
```
68
-
server {
69
-
listen 443 ssl;
70
-
...
71
-
ssl_protocols TLSv1.2 TLSv1.3;
72
-
...
73
-
}
74
-
```
75
-
76
-
Note that we are enabling TLS 1.2 and above, reflecting our ideal scenario.
77
-
62
+
To fix this issue you need to disable TLS 1.0. We also recommend that higher TLS protocol versions are enabled, ideally version 1.2 and above.
63
+
64
+
For most systems, enabling or disabling TLS versions requires a change on the web server configuration file. Therefore, refer to your web server documentation on how to do that.
65
+
66
+
For Nginx, you may use the following snippet as a guideline:
67
+
68
+
```
69
+
server {
70
+
listen 443 ssl;
71
+
...
72
+
ssl_protocols TLSv1.2 TLSv1.3;
73
+
...
74
+
}
75
+
```
76
+
77
+
Note that we are enabling TLS 1.2 and above, reflecting our ideal scenario.
78
+
78
79
If you need to cater to clients with very old TLS support, such as ancient mobile devices, and know what you are doing, you can keep TLS 1.0 enabled, despite the known weaknesses. These issues are not as serious as the SSL protocol weaknesses, but you should weight the need to support older clients with the risk of exposing private data. Moreover, keep in mind that TLS 1.2 support is well over [95%](https://blog.probely.com/how-to-deploy-modern-tls-in-2018-1b9a9cafc454).
To fix this issue you need to disable TLS 1.0. We also recommend that higher TLS protocol versions are enabled, ideally version 1.2 and above.
83
-
84
-
For most systems, enabling or disabling TLS versions requires a change on the web server configuration file. Therefore, refer to your web server documentation on how to do that.
85
-
86
-
If using an Apache server, please refer to the following example:
87
-
88
-
```
89
-
<VirtualHost *:443>
90
-
...
91
-
SSLProtocol -all +TLSv1.2 +TLSv1.3
92
-
...
93
-
</VirtualHost>
94
-
```
95
-
96
-
Note that we are enabling TLS 1.2 and TLS 1.3, reflecting our ideal scenario.
97
-
83
+
To fix this issue you need to disable TLS 1.0. We also recommend that higher TLS protocol versions are enabled, ideally version 1.2 and above.
84
+
85
+
For most systems, enabling or disabling TLS versions requires a change on the web server configuration file. Therefore, refer to your web server documentation on how to do that.
86
+
87
+
If using an Apache server, please refer to the following example:
88
+
89
+
```
90
+
<VirtualHost *:443>
91
+
...
92
+
SSLProtocol -all +TLSv1.2 +TLSv1.3
93
+
...
94
+
</VirtualHost>
95
+
```
96
+
97
+
Note that we are enabling TLS 1.2 and TLS 1.3, reflecting our ideal scenario.
98
+
98
99
If you need to cater to clients with very old TLS support, such as ancient mobile devices, and know what you are doing, you can keep TLS 1.0 enabled, despite the known weaknesses. These issues are not as serious as the SSL protocol weaknesses, but you should weight the need to support older clients with the risk of exposing private data. Moreover, keep in mind that TLS 1.2 support is well over [95%](https://blog.probely.com/how-to-deploy-modern-tls-in-2018-1b9a9cafc454).
0 commit comments