ZAP Scanning Report

Summary of Alerts

Risk LevelNumber of Alerts
High2
Medium4
Low5
Informational2

Alert Detail

High (High)NoSQL Injection - MongoDB
Description

MongoDB query injection may be possible.

URLhttps://wmi.plannaplan.pl/.*
MethodGET
Parametersitemap.xml
Attacksitemap.xml[$regex].*
URLhttps://wmi.plannaplan.pl/
MethodGET
Parameterrobots.txt
Attackrobots.txt[$ne]
Instances2
Solution

Do not trust client side input and escape all data on the server side.

Avoid to use the query input directly into the where and group clauses and upgrade all drivers at the latest available version.

Other information

In some PHP or NodeJS based back end implementations, in order to obtain sensitive data it is possible to inject the "[$ne]" string (or other similar ones) that is processed as an associative array rather than a simple text.

Through this, the queries made to MongoDB will always be true.

Reference

https://arxiv.org/pdf/1506.04082.pdf

https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection.html

CWE Id943
WASC Id19
Source ID1
High (High)None Hashing Algorithm Attack
Description

JWT library accepts none hashing algorithm. none hashing algorithm is used by the JWT in case the integrity of token is already verified.so an attacker can alter the token claims and token will be trusted by the application.

URLhttps://wmi.plannaplan.pl/
MethodGET
ParameterHost
AttackeyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.77-9Vu-_ve-_ve-_vWVq.
URLhttps://wmi.plannaplan.pl/sitemap.xml
MethodGET
ParameterHost
AttackeyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.77-9Vu-_ve-_ve-_vWVq.
URLhttps://wmi.plannaplan.pl/robots.txt
MethodGET
ParameterHost
AttackeyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.77-9Vu-_ve-_ve-_vWVq.
Instances3
Solution

Not allowing none hashing algorithm.

Other information

https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet_for_Java.html

Reference

https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet_for_Java.html

Source ID1
Medium (High)Content Security Policy (CSP) Header Not Set
Description

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.

URLhttps://wmi.plannaplan.pl
MethodGET
URLhttps://wmi.plannaplan.pl/
MethodGET
URLhttps://wmi.plannaplan.pl/sitemap.xml
MethodGET
Instances3
Solution

Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header, to achieve optimal browser support: "Content-Security-Policy" for Chrome 25+, Firefox 23+ and Safari 7+, "X-Content-Security-Policy" for Firefox 4.0+ and Internet Explorer 10+, and "X-WebKit-CSP" for Chrome 14+ and Safari 6+.

Reference

https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy

https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html

http://www.w3.org/TR/CSP/

http://w3c.github.io/webappsec/specs/content-security-policy/csp-specification.dev.html

http://www.html5rocks.com/en/tutorials/security/content-security-policy/

http://caniuse.com/#feat=contentsecuritypolicy

http://content-security-policy.com/

CWE Id16
WASC Id15
Source ID3
Medium (High)Sub Resource Integrity Attribute Missing
Description

The integrity attribute is missing on a script or link tag served by an external server. The integrity tag prevents an attacker who have gained access to this server from injecting a malicious content.

URLhttps://wmi.plannaplan.pl
MethodGET
Evidence<link rel="icon" href="https://plannaplan.pl/img/logo.svg"/>
URLhttps://wmi.plannaplan.pl/
MethodGET
Evidence<link rel="icon" href="https://plannaplan.pl/img/logo.svg"/>
Instances2
Solution

Provide a valid integrity attribute to the tag.

Reference

https://developer.mozilla.org/en/docs/Web/Security/Subresource_Integrity

CWE Id16
WASC Id15
Source ID3
Medium (Medium)Proxy Disclosure
Description

2 proxy server(s) were detected or fingerprinted. This information helps a potential attacker to determine

- A list of targets for an attack against the application.

- Potential vulnerabilities on the proxy servers that service the application.

- The presence or absence of any proxy-based components that might cause attacks against the application to be detected, prevented, or mitigated.

URLhttps://wmi.plannaplan.pl/sitemap.xml
MethodGET
AttackTRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.
URLhttps://wmi.plannaplan.pl/
MethodGET
AttackTRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.
URLhttps://wmi.plannaplan.pl/robots.txt
MethodGET
AttackTRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.
Instances3
Solution

Disable the 'TRACE' method on the proxy servers, as well as the origin web/application server.

Disable the 'OPTIONS' method on the proxy servers, as well as the origin web/application server, if it is not required for other purposes, such as 'CORS' (Cross Origin Resource Sharing).

Configure the web and application servers with custom error pages, to prevent 'fingerprintable' product-specific error pages being leaked to the user in the event of HTTP errors, such as 'TRACK' requests for non-existent pages.

Configure all proxies, application servers, and web servers to prevent disclosure of the technology and version information in the 'Server' and 'X-Powered-By' HTTP response headers.

Other information

Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between OWASP ZAP and the application/web server:

- Apache

- Apache

The following web/application server has been identified:

- Apache/2.4.37 (centos) OpenSSL/1.1.1c

Reference

https://tools.ietf.org/html/rfc7231#section-5.1.2

CWE Id200
WASC Id45
Source ID1
Medium (Medium)X-Frame-Options Header Not Set
Description

X-Frame-Options header is not included in the HTTP response to protect against 'ClickJacking' attacks.

URLhttps://wmi.plannaplan.pl
MethodGET
ParameterX-Frame-Options
URLhttps://wmi.plannaplan.pl/
MethodGET
ParameterX-Frame-Options
Instances2
Solution

Most modern Web browsers support the X-Frame-Options HTTP header. Ensure it's set on all web pages returned by your site (if you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. ALLOW-FROM allows specific websites to frame the web page in supported web browsers).

Reference

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

CWE Id16
WASC Id15
Source ID3
Low (High)Strict-Transport-Security Header Not Set
Description

HTTP Strict Transport Security (HSTS) is a web security policy mechanism whereby a web server declares that complying user agents (such as a web browser) are to interact with it using only secure HTTPS connections (i.e. HTTP layered over TLS/SSL). HSTS is an IETF standards track protocol and is specified in RFC 6797.

URLhttps://wmi.plannaplan.pl/robots.txt
MethodGET
URLhttps://wmi.plannaplan.pl/
MethodGET
URLhttps://wmi.plannaplan.pl
MethodGET
URLhttps://wmi.plannaplan.pl/sitemap.xml
MethodGET
Instances4
Solution

Ensure that your web server, application server, load balancer, etc. is configured to enforce Strict-Transport-Security.

Reference

https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html

https://owasp.org/www-community/Security_Headers

http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

http://caniuse.com/stricttransportsecurity

http://tools.ietf.org/html/rfc6797

CWE Id16
WASC Id15
Source ID3
Low (High)Server Leaks Version Information via "Server" HTTP Response Header Field
Description

The web/application server is leaking version information via the "Server" HTTP response header. Access to such information may facilitate attackers identifying other vulnerabilities your web/application server is subject to.

URLhttps://wmi.plannaplan.pl
MethodGET
EvidenceApache/2.4.37 (centos) OpenSSL/1.1.1c
URLhttps://wmi.plannaplan.pl/sitemap.xml
MethodGET
EvidenceApache/2.4.37 (centos) OpenSSL/1.1.1c
URLhttps://wmi.plannaplan.pl/
MethodGET
EvidenceApache/2.4.37 (centos) OpenSSL/1.1.1c
URLhttps://wmi.plannaplan.pl/robots.txt
MethodGET
EvidenceApache/2.4.37 (centos) OpenSSL/1.1.1c
Instances4
Solution

Ensure that your web server, application server, load balancer, etc. is configured to suppress the "Server" header or provide generic details.

Reference

http://httpd.apache.org/docs/current/mod/core.html#servertokens

http://msdn.microsoft.com/en-us/library/ff648552.aspx#ht_urlscan_007

http://blogs.msdn.com/b/varunm/archive/2013/04/23/remove-unwanted-http-response-headers.aspx

http://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html

CWE Id200
WASC Id13
Source ID3
Low (Medium)X-Content-Type-Options Header Missing
Description

The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

URLhttps://wmi.plannaplan.pl/robots.txt
MethodGET
ParameterX-Content-Type-Options
URLhttps://wmi.plannaplan.pl
MethodGET
ParameterX-Content-Type-Options
URLhttps://wmi.plannaplan.pl/
MethodGET
ParameterX-Content-Type-Options
Instances3
Solution

Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.

If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.

Other information

This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.

At "High" threshold this scan rule will not alert on client or server error responses.

Reference

http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx

https://owasp.org/www-community/Security_Headers

CWE Id16
WASC Id15
Source ID3
Low (Medium)Insufficient Site Isolation Against Spectre Vulnerability
Description

Cross-Origin-Embedder-Policy header is a response header that prevents a document from loading any cross-origin resources that don't explicitly grant the document permission (using CORP or CORS).

URLhttps://wmi.plannaplan.pl/
MethodGET
ParameterCross-Origin-Embedder-Policy
URLhttps://wmi.plannaplan.pl
MethodGET
ParameterCross-Origin-Opener-Policy
URLhttps://wmi.plannaplan.pl/
MethodGET
ParameterCross-Origin-Opener-Policy
URLhttps://wmi.plannaplan.pl/robots.txt
MethodGET
ParameterCross-Origin-Resource-Policy
URLhttps://wmi.plannaplan.pl/
MethodGET
ParameterCross-Origin-Resource-Policy
URLhttps://wmi.plannaplan.pl
MethodGET
ParameterCross-Origin-Embedder-Policy
URLhttps://wmi.plannaplan.pl
MethodGET
ParameterCross-Origin-Resource-Policy
Instances7
Solution

Ensure that the application/web server sets the Cross-Origin-Embedder-Policy header appropriately, and that it sets the Cross-Origin-Embedder-Policy header to 'require-corp' for documents.

If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Embedder-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-embedder-policy).

Reference

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy

CWE Id16
WASC Id14
Source ID3
Low (Medium)Feature Policy Header Not Set
Description

Feature Policy Header is an added layer of security that helps to restrict from unauthorized access or usage of browser/client features by web resources. This policy ensures the user privacy by limiting or specifying the features of the browsers can be used by the web resources. Feature Policy provides a set of standard HTTP headers that allow website owners to limit which features of browsers can be used by the page such as camera, microphone, location, full screen etc.

URLhttps://wmi.plannaplan.pl
MethodGET
URLhttps://wmi.plannaplan.pl/sitemap.xml
MethodGET
URLhttps://wmi.plannaplan.pl/
MethodGET
Instances3
Solution

Ensure that your web server, application server, load balancer, etc. is configured to set the Feature-Policy header.

Reference

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy

https://developers.google.com/web/updates/2018/06/feature-policy

https://scotthelme.co.uk/a-new-security-header-feature-policy/

https://w3c.github.io/webappsec-feature-policy/

https://www.smashingmagazine.com/2018/12/feature-policy/

CWE Id16
WASC Id15
Source ID3
Informational (Medium)Modern Web Application
Description

The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.

URLhttps://wmi.plannaplan.pl
MethodGET
Evidence<script>!function(e){function r(r){for(var n,l,a=r[0],p=r[1],f=r[2],c=0,s=[];c<a.length;c++)l=a[c],Object.prototype.hasOwnProperty.call(o,l)&&o[l]&&s.push(o[l][0]),o[l]=0;for(n in p)Object.prototype.hasOwnProperty.call(p,n)&&(e[n]=p[n]);for(i&&i(r);s.length;)s.shift()();return u.push.apply(u,f||[]),t()}function t(){for(var e,r=0;r<u.length;r++){for(var t=u[r],n=!0,a=1;a<t.length;a++){var p=t[a];0!==o[p]&&(n=!1)}n&&(u.splice(r--,1),e=l(l.s=t[0]))}return e}var n={},o={1:0},u=[];function l(r){if(n[r])return n[r].exports;var t=n[r]={i:r,l:!1,exports:{}};return e[r].call(t.exports,t,t.exports,l),t.l=!0,t.exports}l.m=e,l.c=n,l.d=function(e,r,t){l.o(e,r)||Object.defineProperty(e,r,{enumerable:!0,get:t})},l.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},l.t=function(e,r){if(1&r&&(e=l(e)),8&r)return e;if(4&r&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(l.r(t),Object.defineProperty(t,"default",{enumerable:!0,value:e}),2&r&&"string"!=typeof e)for(var n in e)l.d(t,n,function(r){return e[r]}.bind(null,n));return t},l.n=function(e){var r=e&&e.__esModule?function(){return e.default}:function(){return e};return l.d(r,"a",r),r},l.o=function(e,r){return Object.prototype.hasOwnProperty.call(e,r)},l.p="/";var a=this.webpackJsonpplannaplan=this.webpackJsonpplannaplan||[],p=a.push.bind(a);a.push=r,a=a.slice();for(var f=0;f<a.length;f++)r(a[f]);var i=p;t()}([])</script>
URLhttps://wmi.plannaplan.pl/
MethodGET
Evidence<script>!function(e){function r(r){for(var n,l,a=r[0],p=r[1],f=r[2],c=0,s=[];c<a.length;c++)l=a[c],Object.prototype.hasOwnProperty.call(o,l)&&o[l]&&s.push(o[l][0]),o[l]=0;for(n in p)Object.prototype.hasOwnProperty.call(p,n)&&(e[n]=p[n]);for(i&&i(r);s.length;)s.shift()();return u.push.apply(u,f||[]),t()}function t(){for(var e,r=0;r<u.length;r++){for(var t=u[r],n=!0,a=1;a<t.length;a++){var p=t[a];0!==o[p]&&(n=!1)}n&&(u.splice(r--,1),e=l(l.s=t[0]))}return e}var n={},o={1:0},u=[];function l(r){if(n[r])return n[r].exports;var t=n[r]={i:r,l:!1,exports:{}};return e[r].call(t.exports,t,t.exports,l),t.l=!0,t.exports}l.m=e,l.c=n,l.d=function(e,r,t){l.o(e,r)||Object.defineProperty(e,r,{enumerable:!0,get:t})},l.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},l.t=function(e,r){if(1&r&&(e=l(e)),8&r)return e;if(4&r&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(l.r(t),Object.defineProperty(t,"default",{enumerable:!0,value:e}),2&r&&"string"!=typeof e)for(var n in e)l.d(t,n,function(r){return e[r]}.bind(null,n));return t},l.n=function(e){var r=e&&e.__esModule?function(){return e.default}:function(){return e};return l.d(r,"a",r),r},l.o=function(e,r){return Object.prototype.hasOwnProperty.call(e,r)},l.p="/";var a=this.webpackJsonpplannaplan=this.webpackJsonpplannaplan||[],p=a.push.bind(a);a.push=r,a=a.slice();for(var f=0;f<a.length;f++)r(a[f]);var i=p;t()}([])</script>
Instances2
Solution

This is an informational alert and so no changes are required.

Other information

No links have been found while there are scripts, which is an indication that this is a modern web application.

Reference

Source ID3
Informational (Medium)Non-Storable Content
Description

The response contents are not storable by caching components such as proxy servers. If the response does not contain sensitive, personal or user-specific information, it may benefit from being stored and cached, to improve performance.

URLhttps://wmi.plannaplan.pl
MethodGET
Evidenceno-store
URLhttps://wmi.plannaplan.pl/
MethodGET
Evidenceno-store
URLhttps://wmi.plannaplan.pl/sitemap.xml
MethodGET
Evidenceno-store
URLhttps://wmi.plannaplan.pl/robots.txt
MethodGET
Evidenceno-store
Instances4
Solution

The content may be marked as storable by ensuring that the following conditions are satisfied:

The request method must be understood by the cache and defined as being cacheable ("GET", "HEAD", and "POST" are currently defined as cacheable)

The response status code must be understood by the cache (one of the 1XX, 2XX, 3XX, 4XX, or 5XX response classes are generally understood)

The "no-store" cache directive must not appear in the request or response header fields

For caching by "shared" caches such as "proxy" caches, the "private" response directive must not appear in the response

For caching by "shared" caches such as "proxy" caches, the "Authorization" header field must not appear in the request, unless the response explicitly allows it (using one of the "must-revalidate", "public", or "s-maxage" Cache-Control response directives)

In addition to the conditions above, at least one of the following conditions must also be satisfied by the response:

It must contain an "Expires" header field

It must contain a "max-age" response directive

For "shared" caches such as "proxy" caches, it must contain a "s-maxage" response directive

It must contain a "Cache Control Extension" that allows it to be cached

It must have a status code that is defined as cacheable by default (200, 203, 204, 206, 300, 301, 404, 405, 410, 414, 501).

Reference

https://tools.ietf.org/html/rfc7234

https://tools.ietf.org/html/rfc7231

http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html (obsoleted by rfc7234)

CWE Id524
WASC Id13
Source ID3