# ZAP Scanning Report

### Summary of Alerts

Risk Level | Number of Alerts
--- | ---
High | 2
Medium | 4
Low | 5
Informational | 2

### Alert Detail

High (High) | NoSQL Injection - MongoDB
--- | ---
Description | MongoDB query injection may be possible.
URL | https://wmi.plannaplan.pl/.*
Method | GET
Parameter | sitemap.xml
Attack | sitemap.xml[$regex].*
URL | https://wmi.plannaplan.pl/
Method | GET
Parameter | robots.txt
Attack | robots.txt[$ne]
Instances | 2
Solution | Do not trust client side input and escape all data on the server side. Avoid to use the query input directly into the where and group clauses and upgrade all drivers at the latest available version.
Other information | In some PHP or NodeJS based back end implementations, in order to obtain sensitive data it is possible to inject the "[$ne]" string (or other similar ones) that is processed as an associative array rather than a simple text. Through this, the queries made to MongoDB will always be true.
Reference | https://arxiv.org/pdf/1506.04082.pdf https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection.html
CWE Id | 943
WASC Id | 19
Source ID | 1

High (High) | None Hashing Algorithm Attack
--- | ---
Description | JWT library accepts none hashing algorithm. none hashing algorithm is used by the JWT in case the integrity of token is already verified.so an attacker can alter the token claims and token will be trusted by the application.
URL | https://wmi.plannaplan.pl/
Method | GET
Parameter | Host
Attack | eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.77-9Vu-_ve-_ve-_vWVq.
URL | https://wmi.plannaplan.pl/sitemap.xml
Method | GET
Parameter | Host
Attack | eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.77-9Vu-_ve-_ve-_vWVq.
URL | https://wmi.plannaplan.pl/robots.txt
Method | GET
Parameter | Host
Attack | eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.77-9Vu-_ve-_ve-_vWVq.
Instances | 3
Solution | Not allowing none hashing algorithm.
Other information | https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet_for_Java.html
Reference | https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet_for_Java.html
Source ID | 1

Medium (High) | Content Security Policy (CSP) Header Not Set
--- | ---

Description

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.

URL | https://wmi.plannaplan.pl
Method | GET
URL | https://wmi.plannaplan.pl/
Method | GET
URL | https://wmi.plannaplan.pl/sitemap.xml
Method | GET
Instances | 3
Solution | Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header, to achieve optimal browser support: "Content-Security-Policy" for Chrome 25+, Firefox 23+ and Safari 7+, "X-Content-Security-Policy" for Firefox 4.0+ and Internet Explorer 10+, and "X-WebKit-CSP" for Chrome 14+ and Safari 6+.

Reference

https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy

https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html

http://www.w3.org/TR/CSP/

http://w3c.github.io/webappsec/specs/content-security-policy/csp-specification.dev.html

http://www.html5rocks.com/en/tutorials/security/content-security-policy/

http://caniuse.com/#feat=contentsecuritypolicy

http://content-security-policy.com/

CWE Id | 16
WASC Id | 15
Source ID | 3

Medium (High) | Sub Resource Integrity Attribute Missing
--- | ---
Description | The integrity attribute is missing on a script or link tag served by an external server. The integrity tag prevents an attacker who have gained access to this server from injecting a malicious content.
URL | https://wmi.plannaplan.pl
Method | GET
Evidence | <link rel="icon" href="https://plannaplan.pl/img/logo.svg"/>
URL | https://wmi.plannaplan.pl/
Method | GET
Evidence | <link rel="icon" href="https://plannaplan.pl/img/logo.svg"/>
Instances | 2
Solution | Provide a valid integrity attribute to the tag.
Reference | https://developer.mozilla.org/en/docs/Web/Security/Subresource_Integrity
CWE Id | 16
WASC Id | 15
Source ID | 3

Medium (Medium) | Proxy Disclosure
--- | ---

Description

2 proxy server(s) were detected or fingerprinted. This information helps a potential attacker to determine

- A list of targets for an attack against the application.

- Potential vulnerabilities on the proxy servers that service the application.

- The presence or absence of any proxy-based components that might cause attacks against the application to be detected, prevented, or mitigated.

URL | https://wmi.plannaplan.pl/sitemap.xml
Method | GET
Attack | TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.
URL | https://wmi.plannaplan.pl/
Method | GET
Attack | TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.
URL | https://wmi.plannaplan.pl/robots.txt
Method | GET
Attack | TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.
Instances | 3

Solution

Disable the 'TRACE' method on the proxy servers, as well as the origin web/application server.

Disable the 'OPTIONS' method on the proxy servers, as well as the origin web/application server, if it is not required for other purposes, such as 'CORS' (Cross Origin Resource Sharing).

Configure the web and application servers with custom error pages, to prevent 'fingerprintable' product-specific error pages being leaked to the user in the event of HTTP errors, such as 'TRACK' requests for non-existent pages.

Configure all proxies, application servers, and web servers to prevent disclosure of the technology and version information in the 'Server' and 'X-Powered-By' HTTP response headers.

Other information | Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between OWASP ZAP and the application/web server: - Apache - Apache The following web/application server has been identified: - Apache/2.4.37 (centos) OpenSSL/1.1.1c
Reference | https://tools.ietf.org/html/rfc7231#section-5.1.2
CWE Id | 200
WASC Id | 45
Source ID | 1

Medium (Medium) | X-Frame-Options Header Not Set
--- | ---
Description | X-Frame-Options header is not included in the HTTP response to protect against 'ClickJacking' attacks.
URL | https://wmi.plannaplan.pl
Method | GET
Parameter | X-Frame-Options
URL | https://wmi.plannaplan.pl/
Method | GET
Parameter | X-Frame-Options
Instances | 2

Solution

Most modern Web browsers support the X-Frame-Options HTTP header. Ensure it's set on all web pages returned by your site (if you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. ALLOW-FROM allows specific websites to frame the web page in supported web browsers).

Reference | https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
CWE Id | 16
WASC Id | 15
Source ID | 3

Low (High) | Strict-Transport-Security Header Not Set
--- | ---
Description | HTTP Strict Transport Security (HSTS) is a web security policy mechanism whereby a web server declares that complying user agents (such as a web browser) are to interact with it using only secure HTTPS connections (i.e. HTTP layered over TLS/SSL). HSTS is an IETF standards track protocol and is specified in RFC 6797.
URL | https://wmi.plannaplan.pl/robots.txt
Method | GET
URL | https://wmi.plannaplan.pl/
Method | GET
URL | https://wmi.plannaplan.pl
Method | GET
URL | https://wmi.plannaplan.pl/sitemap.xml
Method | GET
Instances | 4
Solution | Ensure that your web server, application server, load balancer, etc. is configured to enforce Strict-Transport-Security.
Reference | https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html https://owasp.org/www-community/Security_Headers http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security http://caniuse.com/stricttransportsecurity http://tools.ietf.org/html/rfc6797
CWE Id | 16
WASC Id | 15
Source ID | 3

Low (High) | Server Leaks Version Information via "Server" HTTP Response Header Field
--- | ---
Description | The web/application server is leaking version information via the "Server" HTTP response header. Access to such information may facilitate attackers identifying other vulnerabilities your web/application server is subject to.
URL | https://wmi.plannaplan.pl
Method | GET
Evidence | Apache/2.4.37 (centos) OpenSSL/1.1.1c
URL | https://wmi.plannaplan.pl/sitemap.xml
Method | GET
Evidence | Apache/2.4.37 (centos) OpenSSL/1.1.1c
URL | https://wmi.plannaplan.pl/
Method | GET
Evidence | Apache/2.4.37 (centos) OpenSSL/1.1.1c
URL | https://wmi.plannaplan.pl/robots.txt
Method | GET
Evidence | Apache/2.4.37 (centos) OpenSSL/1.1.1c
Instances | 4
Solution | Ensure that your web server, application server, load balancer, etc. is configured to suppress the "Server" header or provide generic details.
Reference | http://httpd.apache.org/docs/current/mod/core.html#servertokens http://msdn.microsoft.com/en-us/library/ff648552.aspx#ht_urlscan_007 http://blogs.msdn.com/b/varunm/archive/2013/04/23/remove-unwanted-http-response-headers.aspx http://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html
CWE Id | 200
WASC Id | 13
Source ID | 3

Low (Medium) | X-Content-Type-Options Header Missing
--- | ---

Description

The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

URL | https://wmi.plannaplan.pl/robots.txt
Method | GET
Parameter | X-Content-Type-Options
URL | https://wmi.plannaplan.pl
Method | GET
Parameter | X-Content-Type-Options
URL | https://wmi.plannaplan.pl/
Method | GET
Parameter | X-Content-Type-Options
Instances | 3
Solution | Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages. If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.
Other information | This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type. At "High" threshold this scan rule will not alert on client or server error responses.
Reference | http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx https://owasp.org/www-community/Security_Headers
CWE Id | 16
WASC Id | 15
Source ID | 3

Low (Medium) | Insufficient Site Isolation Against Spectre Vulnerability
--- | ---
Description | Cross-Origin-Embedder-Policy header is a response header that prevents a document from loading any cross-origin resources that don't explicitly grant the document permission (using CORP or CORS).
URL | https://wmi.plannaplan.pl/
Method | GET
Parameter | Cross-Origin-Embedder-Policy
URL | https://wmi.plannaplan.pl
Method | GET
Parameter | Cross-Origin-Opener-Policy
URL | https://wmi.plannaplan.pl/
Method | GET
Parameter | Cross-Origin-Opener-Policy
URL | https://wmi.plannaplan.pl/robots.txt
Method | GET
Parameter | Cross-Origin-Resource-Policy
URL | https://wmi.plannaplan.pl/
Method | GET
Parameter | Cross-Origin-Resource-Policy
URL | https://wmi.plannaplan.pl
Method | GET
Parameter | Cross-Origin-Embedder-Policy
URL | https://wmi.plannaplan.pl
Method | GET
Parameter | Cross-Origin-Resource-Policy
Instances | 7

Solution

Ensure that the application/web server sets the Cross-Origin-Embedder-Policy header appropriately, and that it sets the Cross-Origin-Embedder-Policy header to 'require-corp' for documents.

If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Embedder-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-embedder-policy).

Reference | https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy
CWE Id | 16
WASC Id | 14
Source ID | 3

Low (Medium) | Feature Policy Header Not Set
--- | ---

Description

Feature Policy Header is an added layer of security that helps to restrict from unauthorized access or usage of browser/client features by web resources. This policy ensures the user privacy by limiting or specifying the features of the browsers can be used by the web resources. Feature Policy provides a set of standard HTTP headers that allow website owners to limit which features of browsers can be used by the page such as camera, microphone, location, full screen etc.

URL | https://wmi.plannaplan.pl
Method | GET
URL | https://wmi.plannaplan.pl/sitemap.xml
Method | GET
URL | https://wmi.plannaplan.pl/
Method | GET
Instances | 3
Solution | Ensure that your web server, application server, load balancer, etc. is configured to set the Feature-Policy header.
Reference | https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy https://developers.google.com/web/updates/2018/06/feature-policy https://scotthelme.co.uk/a-new-security-header-feature-policy/ https://w3c.github.io/webappsec-feature-policy/ https://www.smashingmagazine.com/2018/12/feature-policy/
CWE Id | 16
WASC Id | 15
Source ID | 3

Informational (Medium) | Modern Web Application
--- | ---
Description | The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.
URL | https://wmi.plannaplan.pl
Method | GET

Evidence

<script>!function(e){function r(r){for(var n,l,a=r[0],p=r[1],f=r[2],c=0,s=[];c<a.length;c++)l=a[c],Object.prototype.hasOwnProperty.call(o,l)&&o[l]&&s.push(o[l][0]),o[l]=0;for(n in p)Object.prototype.hasOwnProperty.call(p,n)&&(e[n]=p[n]);for(i&&i(r);s.length;)s.shift()();return u.push.apply(u,f||[]),t()}function t(){for(var e,r=0;r<u.length;r++){for(var t=u[r],n=!0,a=1;a<t.length;a++){var p=t[a];0!==o[p]&&(n=!1)}n&&(u.splice(r--,1),e=l(l.s=t[0]))}return e}var n={},o={1:0},u=[];function l(r){if(n[r])return n[r].exports;var t=n[r]={i:r,l:!1,exports:{}};return e[r].call(t.exports,t,t.exports,l),t.l=!0,t.exports}l.m=e,l.c=n,l.d=function(e,r,t){l.o(e,r)||Object.defineProperty(e,r,{enumerable:!0,get:t})},l.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},l.t=function(e,r){if(1&r&&(e=l(e)),8&r)return e;if(4&r&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(l.r(t),Object.defineProperty(t,"default",{enumerable:!0,value:e}),2&r&&"string"!=typeof e)for(var n in e)l.d(t,n,function(r){return e[r]}.bind(null,n));return t},l.n=function(e){var r=e&&e.__esModule?function(){return e.default}:function(){return e};return l.d(r,"a",r),r},l.o=function(e,r){return Object.prototype.hasOwnProperty.call(e,r)},l.p="/";var a=this.webpackJsonpplannaplan=this.webpackJsonpplannaplan||[],p=a.push.bind(a);a.push=r,a=a.slice();for(var f=0;f<a.length;f++)r(a[f]);var i=p;t()}([])</script>

URL | https://wmi.plannaplan.pl/
Method | GET

Evidence

<script>!function(e){function r(r){for(var n,l,a=r[0],p=r[1],f=r[2],c=0,s=[];c<a.length;c++)l=a[c],Object.prototype.hasOwnProperty.call(o,l)&&o[l]&&s.push(o[l][0]),o[l]=0;for(n in p)Object.prototype.hasOwnProperty.call(p,n)&&(e[n]=p[n]);for(i&&i(r);s.length;)s.shift()();return u.push.apply(u,f||[]),t()}function t(){for(var e,r=0;r<u.length;r++){for(var t=u[r],n=!0,a=1;a<t.length;a++){var p=t[a];0!==o[p]&&(n=!1)}n&&(u.splice(r--,1),e=l(l.s=t[0]))}return e}var n={},o={1:0},u=[];function l(r){if(n[r])return n[r].exports;var t=n[r]={i:r,l:!1,exports:{}};return e[r].call(t.exports,t,t.exports,l),t.l=!0,t.exports}l.m=e,l.c=n,l.d=function(e,r,t){l.o(e,r)||Object.defineProperty(e,r,{enumerable:!0,get:t})},l.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},l.t=function(e,r){if(1&r&&(e=l(e)),8&r)return e;if(4&r&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(l.r(t),Object.defineProperty(t,"default",{enumerable:!0,value:e}),2&r&&"string"!=typeof e)for(var n in e)l.d(t,n,function(r){return e[r]}.bind(null,n));return t},l.n=function(e){var r=e&&e.__esModule?function(){return e.default}:function(){return e};return l.d(r,"a",r),r},l.o=function(e,r){return Object.prototype.hasOwnProperty.call(e,r)},l.p="/";var a=this.webpackJsonpplannaplan=this.webpackJsonpplannaplan||[],p=a.push.bind(a);a.push=r,a=a.slice();for(var f=0;f<a.length;f++)r(a[f]);var i=p;t()}([])</script>

Instances | 2
Solution | This is an informational alert and so no changes are required.
Other information | No links have been found while there are scripts, which is an indication that this is a modern web application.
Reference |
Source ID | 3

Informational (Medium) | Non-Storable Content
--- | ---
Description | The response contents are not storable by caching components such as proxy servers. If the response does not contain sensitive, personal or user-specific information, it may benefit from being stored and cached, to improve performance.
URL | https://wmi.plannaplan.pl
Method | GET
Evidence | no-store
URL | https://wmi.plannaplan.pl/
Method | GET
Evidence | no-store
URL | https://wmi.plannaplan.pl/sitemap.xml
Method | GET
Evidence | no-store
URL | https://wmi.plannaplan.pl/robots.txt
Method | GET
Evidence | no-store
Instances | 4

Solution

The content may be marked as storable by ensuring that the following conditions are satisfied:

The request method must be understood by the cache and defined as being cacheable ("GET", "HEAD", and "POST" are currently defined as cacheable)

The response status code must be understood by the cache (one of the 1XX, 2XX, 3XX, 4XX, or 5XX response classes are generally understood)

The "no-store" cache directive must not appear in the request or response header fields

For caching by "shared" caches such as "proxy" caches, the "private" response directive must not appear in the response

For caching by "shared" caches such as "proxy" caches, the "Authorization" header field must not appear in the request, unless the response explicitly allows it (using one of the "must-revalidate", "public", or "s-maxage" Cache-Control response directives)

In addition to the conditions above, at least one of the following conditions must also be satisfied by the response:

It must contain an "Expires" header field

It must contain a "max-age" response directive

For "shared" caches such as "proxy" caches, it must contain a "s-maxage" response directive

It must contain a "Cache Control Extension" that allows it to be cached

It must have a status code that is defined as cacheable by default (200, 203, 204, 206, 300, 301, 404, 405, 410, 414, 501).

Reference | https://tools.ietf.org/html/rfc7234 https://tools.ietf.org/html/rfc7231 http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html (obsoleted by rfc7234)
CWE Id | 524
WASC Id | 13
Source ID | 3