1283 lines
59 KiB
HTML
1283 lines
59 KiB
HTML
<html>
|
|
<head>
|
|
<META http-equiv="Content-Type" content="text/html; charset=UTF-8">
|
|
<title>ZAP Scanning Report</title>
|
|
<style>
|
|
body{
|
|
font-family: "Helvetica Neue",Helvetica,Arial,sans-serif;
|
|
color: #000;
|
|
font-size: 13px;
|
|
}
|
|
h1{
|
|
text-align: center;
|
|
font-weight: bold;
|
|
font-size: 32px
|
|
}
|
|
h3{
|
|
font-size: 16px;
|
|
}
|
|
table{
|
|
border: none;
|
|
font-size: 13px;
|
|
}
|
|
td, th {
|
|
padding: 3px 4px;
|
|
word-break: break-word;
|
|
}
|
|
th{
|
|
font-weight: bold;
|
|
}
|
|
.results th{
|
|
text-align: left;
|
|
}
|
|
.spacer{
|
|
margin: 10px;
|
|
}
|
|
.spacer-lg{
|
|
margin: 40px;
|
|
}
|
|
.indent1{
|
|
padding: 4px 20px;
|
|
}
|
|
.indent2{
|
|
padding: 4px 40px;
|
|
}
|
|
.risk-high{
|
|
background-color: red;
|
|
color: #FFF;
|
|
}
|
|
.risk-medium{
|
|
background-color: orange;
|
|
color: #FFF;
|
|
}
|
|
.risk-low{
|
|
background-color: yellow;
|
|
color: #000;
|
|
}
|
|
.risk-info{
|
|
background-color: blue;
|
|
color: #FFF;
|
|
}
|
|
.summary th{
|
|
color: #FFF;
|
|
}
|
|
</style>
|
|
</head>
|
|
<body>
|
|
<h1>
|
|
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAABqbAAAamwHdbkbTAAAAB3RJTUUH4QsKDDQPKy6k8AAABxpJREFUWMO9l31sVWcdxz+/55xzbwt9QddJExClvIzNxTKJDZi22oJSbFZpmRb4g8sfhpEIwXQNTKh0NYgiMKIwo5AsdIxdQldGNBN5W2OTFRVcIZE1YwExcXOdc1DK+nLvOc/PP87tC9CWsj98bp6ck3Ofc57v7+37/T3wYGMucBR4F/gK/8exAugAdPXq1bpx40YFekZdHYuP+8PuGP+lAc8CmzIyMtLq6uqora3FcRwAzp49m/7Wv5O95tsNEfyEKvwH9B1V2hT7GnB+PABkhGePAvVA9dy5c6mvr2fp0qX3LOru7iYrK4toSQ1OXhGKohpOiyVQe0NVn9PGFb8iFofGFSMCMMPulwEXgbdXrlxZ3dHRQXt7+4ibA2RmZtLc3Ex/y/O4fg8RMUSMS8RxiRiPqPE+4xrnl07syA3Q+aN5wADlwO1oNPpqQ0NDfl9fH4cPH2bOnDn3dV9VVRWVlVV88vsteNF0XCO4xuA6Bs9xiBgPz/EmueKcIxavHyk/BPjnli1bpm3btu1TZ2hmxkTk8aeYMK8aay1WFVWwqgSqBDYgqQFJGxygccWa4e86IhJpbW39Zk5ODgUFBZ8KwOLFZeyr/wHZs0vw0jMxIqFpAuFt+EOYZ/OrAi41t96dhF8HThcWFnpnzpwhGo0+MIhnamvZs+8AM55uIhn4+Cnrkza8Wqv4NiBhfXwNCgxy3jauuKMKPOCPrpHSU2fOUlJS8sAg8qZP50bGY0xeuIFk4JO0SnIYiMAqSRuQDPyPgsbqh++ugqSsPXGC+WsoLS1lzZqnHxhA40svcfPvfyDNjRARwTOCJ+E0IjgiOGIwRnIkFl97NwBMX9dPvEfLSC+t5cCB/eTk5Ix78ylTplBcXMxDjy3EweIZISKSqoxwcyOCYwRXHETkuSEAsTjE4kVGTLrjpdP7p33U1NTQ2dk5bgCbN28Ow7BoA8YmcVOWR1KWuyKIgEEwYjBiJhN75Ushr15qRp747g9dcRZ4RtCuf3HhdBMlpQuZNm3auAAUFBRw+fJlWl/dy9SCaqwGIBIyJGBTUwemWqzy/mAIRPmaEUGsJeNbz+IVfJ+ioiI2bNgwbi80NTUxJWciV47/GM9Lwwg4CA6CSblbBqYYRPjqEACRR8JaVcRPkPHlJ5m66kX27W8kL2/6uMPR3t7Ox+++yQcXjmLEIEYQA8YIkuIHSYVDkBnDk3DSEDwAi5c5mUfWNtGVPovc3FwOHTp0XwDZ2dm0nTvH9Td+zSedVxDVkIQAEQ1BoIgKCpnmflqpQcAXyjYxo6KeVatWUVZWRiKRGPO1+fPns2vXLjoOr7uvFA8HcHMoQ8IHmkqOINnH1d81kJeXR0VFRcqKkUcQBLS0tHD79u2QXHq7UmkIqgKqoIKKAnQPNiSqXFG0QFVCXbcGK4pVIdnTBcDOnTupqqoa06q2tjZKS0uZ8LmZzKiox5nwWXzfx9qBfmGgCkDRa4MeUNE3repg2QSEiwMFk5nDF8vrWLZsGTNnzqS9vX1UAEVFRezYsYOeD68y8fNPEFifAL2rDAfBnJdhGv0NzzgtoYYbHGOICkSMIWKEqBE8x+X91v18cKGJyspKDh48SFZW1ohAlixZQstfLzM99iK9iQQJqySsxVfFDyz9Nolv/fw7gumsPtIbMZE0zxhcR3DFEDVCZIDTjeA5Drb3Jv84sYOu639j69atNDQ0jAgiN3cyPQ/NJXvhM/QnEwRW8dWSDAL6bbLTHlyee0cVWNWfBhpgVbEWfFUSqiSGqVoyCCCaxayndjKn+nm2736BzIyJHDt27B4AFy9eovvtU3R3nA5DkFJEXwNUtWHEptSsPtIXNW7UMy4mJSLeMA+4IrhCKC6A46XR+VYz772xj/z8fJqampg1a9bg906ePElZWRlZy3+DZuSGPUGQ/G/QuDznHjVMeaEyaS2+WqxVbMryxMDVKv0W+qzSr0pPoo/Mx8uZs/51rgdTmD17NrFYbJArFi9ezKZNm7h1dD1B4JO0PgG23KR6QxnlYLHXM846z7i4oX4P6vmA9Q6ENMsQZyiGxK1OPjr5M5Kd77B7925qamoAWLBgAX+59jFU7tmivy3fPvq5INXDSyx+3DXOd1xx8YzBiGBMKCIDwmKMDLEWEnoMUDdK37U2bp/6BQ9PSueV+BEWLVpEdnYW3be6f67wo7EOJoMgiMX3uuKs84zBEQcjghjBMCAmhF1niskGCMaiqFWs8ehrj+Off5nCwkK2b99OcXExwFTgvdEB3AmizIi85oqTNgDCSKrPFWV4DFRD/beqWLX4YUXdst0ffk+b168CVqZWpwN9YwO4Wzhi8c1GpM6ISTcYREJPMOSAQYZLHc1upY5meyjfBq/XAUwGbgL9Y4dgrBGLFwtSITAPkekCk1L73wS9qsoFxR6nceWfx/O5/wGLCSMJ+zJrfwAAAABJRU5ErkJggg==">
|
|
ZAP Scanning Report
|
|
|
|
</h1>
|
|
<p>
|
|
</p>
|
|
<h3>Summary of Alerts</h3>
|
|
<table width="45%" class="summary">
|
|
<tr bgcolor="#666666">
|
|
<th width="45%" height="24">Risk
|
|
Level</th><th width="55%" align="center">Number
|
|
of Alerts</th>
|
|
</tr>
|
|
<tr bgcolor="#e8e8e8">
|
|
<td><a href="#high">High</a></td><td align="center">2</td>
|
|
</tr>
|
|
<tr bgcolor="#e8e8e8">
|
|
<td><a href="#medium">Medium</a></td><td align="center">4</td>
|
|
</tr>
|
|
<tr bgcolor="#e8e8e8">
|
|
<td><a href="#low">Low</a></td><td align="center">5</td>
|
|
</tr>
|
|
<tr bgcolor="#e8e8e8">
|
|
<td><a href="#info">Informational</a></td><td align="center">2</td>
|
|
</tr>
|
|
</table>
|
|
<div class="spacer-lg"></div>
|
|
<h3>Alert Detail</h3>
|
|
<div class="spacer"></div>
|
|
<table width="100%" class="results">
|
|
|
|
|
|
|
|
<tr height="24" class="risk-high">
|
|
<th width="20%"><a name="high"></a>High (High)</th><th width="80%">NoSQL Injection - MongoDB</th>
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Description</td><td width="80%"><p>MongoDB query injection may be possible.</p></td>
|
|
</tr>
|
|
<TR vAlign="top">
|
|
<TD colspan="2"></TD>
|
|
</TR>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/.*</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Parameter</td><td width="80%">sitemap.xml</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Attack</td><td width="80%">sitemap.xml[$regex].*</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Parameter</td><td width="80%">robots.txt</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Attack</td><td width="80%">robots.txt[$ne]</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Instances</td><td width="80%">2</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Solution</td><td width="80%"><p>Do not trust client side input and escape all data on the server side. </p><p>Avoid to use the query input directly into the where and group clauses and upgrade all drivers at the latest available version.</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Other information</td><td width="80%"><p>In some PHP or NodeJS based back end implementations, in order to obtain sensitive data it is possible to inject the "[$ne]" string (or other similar ones) that is processed as an associative array rather than a simple text.</p><p>Through this, the queries made to MongoDB will always be true.</p></td>
|
|
</tr>
|
|
<TR vAlign="top">
|
|
<TD colspan="2"></TD>
|
|
</TR>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Reference</td><td width="80%"><p>https://arxiv.org/pdf/1506.04082.pdf</p><p>https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/07-Input_Validation_Testing/05.6-Testing_for_NoSQL_Injection.html</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">CWE Id</td><td width="80%">943</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">WASC Id</td><td width="80%">19</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Source ID</td><td width="80%">1</td>
|
|
</tr>
|
|
|
|
</table>
|
|
<div class="spacer"></div>
|
|
<table width="100%" class="results">
|
|
|
|
|
|
|
|
<tr height="24" class="risk-high">
|
|
<th width="20%"><a name="high"></a>High (High)</th><th width="80%">None Hashing Algorithm Attack</th>
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Description</td><td width="80%"><p>JWT library accepts none hashing algorithm. none hashing algorithm is used by the JWT in case the integrity of token is already verified.so an attacker can alter the token claims and token will be trusted by the application.</p></td>
|
|
</tr>
|
|
<TR vAlign="top">
|
|
<TD colspan="2"></TD>
|
|
</TR>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Parameter</td><td width="80%">Host</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Attack</td><td width="80%">eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.77-9Vu-_ve-_ve-_vWVq.</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/sitemap.xml</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Parameter</td><td width="80%">Host</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Attack</td><td width="80%">eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.77-9Vu-_ve-_ve-_vWVq.</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/robots.txt</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Parameter</td><td width="80%">Host</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Attack</td><td width="80%">eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.77-9Vu-_ve-_ve-_vWVq.</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Instances</td><td width="80%">3</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Solution</td><td width="80%"><p>Not allowing none hashing algorithm.</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Other information</td><td width="80%"><p>https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet_for_Java.html</p></td>
|
|
</tr>
|
|
<TR vAlign="top">
|
|
<TD colspan="2"></TD>
|
|
</TR>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Reference</td><td width="80%"><p>https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_Cheat_Sheet_for_Java.html</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Source ID</td><td width="80%">1</td>
|
|
</tr>
|
|
|
|
</table>
|
|
<div class="spacer"></div>
|
|
<table width="100%" class="results">
|
|
|
|
|
|
|
|
<tr height="24" class="risk-medium">
|
|
<th width="20%"><a name="medium"></a>Medium (High)</th><th width="80%">Content Security Policy (CSP) Header Not Set</th>
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Description</td><td width="80%"><p>Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.</p></td>
|
|
</tr>
|
|
<TR vAlign="top">
|
|
<TD colspan="2"></TD>
|
|
</TR>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/sitemap.xml</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Instances</td><td width="80%">3</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Solution</td><td width="80%"><p>Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header, to achieve optimal browser support: "Content-Security-Policy" for Chrome 25+, Firefox 23+ and Safari 7+, "X-Content-Security-Policy" for Firefox 4.0+ and Internet Explorer 10+, and "X-WebKit-CSP" for Chrome 14+ and Safari 6+.</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Reference</td><td width="80%"><p>https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy</p><p>https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html</p><p>http://www.w3.org/TR/CSP/</p><p>http://w3c.github.io/webappsec/specs/content-security-policy/csp-specification.dev.html</p><p>http://www.html5rocks.com/en/tutorials/security/content-security-policy/</p><p>http://caniuse.com/#feat=contentsecuritypolicy</p><p>http://content-security-policy.com/</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">CWE Id</td><td width="80%">16</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">WASC Id</td><td width="80%">15</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Source ID</td><td width="80%">3</td>
|
|
</tr>
|
|
|
|
</table>
|
|
<div class="spacer"></div>
|
|
<table width="100%" class="results">
|
|
|
|
|
|
|
|
<tr height="24" class="risk-medium">
|
|
<th width="20%"><a name="medium"></a>Medium (High)</th><th width="80%">Sub Resource Integrity Attribute Missing</th>
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Description</td><td width="80%"><p>The integrity attribute is missing on a script or link tag served by an external server. The integrity tag prevents an attacker who have gained access to this server from injecting a malicious content. </p></td>
|
|
</tr>
|
|
<TR vAlign="top">
|
|
<TD colspan="2"></TD>
|
|
</TR>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Evidence</td><td width="80%"><link rel="icon" href="https://plannaplan.pl/img/logo.svg"/></td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Evidence</td><td width="80%"><link rel="icon" href="https://plannaplan.pl/img/logo.svg"/></td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Instances</td><td width="80%">2</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Solution</td><td width="80%"><p>Provide a valid integrity attribute to the tag.</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Reference</td><td width="80%"><p>https://developer.mozilla.org/en/docs/Web/Security/Subresource_Integrity</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">CWE Id</td><td width="80%">16</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">WASC Id</td><td width="80%">15</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Source ID</td><td width="80%">3</td>
|
|
</tr>
|
|
|
|
</table>
|
|
<div class="spacer"></div>
|
|
<table width="100%" class="results">
|
|
|
|
|
|
|
|
<tr height="24" class="risk-medium">
|
|
<th width="20%"><a name="medium"></a>Medium (Medium)</th><th width="80%">Proxy Disclosure</th>
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Description</td><td width="80%"><p>2 proxy server(s) were detected or fingerprinted. This information helps a potential attacker to determine </p><p> - A list of targets for an attack against the application.</p><p> - Potential vulnerabilities on the proxy servers that service the application.</p><p> - The presence or absence of any proxy-based components that might cause attacks against the application to be detected, prevented, or mitigated. </p></td>
|
|
</tr>
|
|
<TR vAlign="top">
|
|
<TD colspan="2"></TD>
|
|
</TR>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/sitemap.xml</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Attack</td><td width="80%">TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Attack</td><td width="80%">TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/robots.txt</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Attack</td><td width="80%">TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Instances</td><td width="80%">3</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Solution</td><td width="80%"><p>Disable the 'TRACE' method on the proxy servers, as well as the origin web/application server.</p><p>Disable the 'OPTIONS' method on the proxy servers, as well as the origin web/application server, if it is not required for other purposes, such as 'CORS' (Cross Origin Resource Sharing).</p><p>Configure the web and application servers with custom error pages, to prevent 'fingerprintable' product-specific error pages being leaked to the user in the event of HTTP errors, such as 'TRACK' requests for non-existent pages.</p><p>Configure all proxies, application servers, and web servers to prevent disclosure of the technology and version information in the 'Server' and 'X-Powered-By' HTTP response headers.</p><p></p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Other information</td><td width="80%"><p>Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between OWASP ZAP and the application/web server: </p><p>- Apache</p><p>- Apache</p><p>The following web/application server has been identified: </p><p>- Apache/2.4.37 (centos) OpenSSL/1.1.1c</p><p></p></td>
|
|
</tr>
|
|
<TR vAlign="top">
|
|
<TD colspan="2"></TD>
|
|
</TR>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Reference</td><td width="80%"><p>https://tools.ietf.org/html/rfc7231#section-5.1.2</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">CWE Id</td><td width="80%">200</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">WASC Id</td><td width="80%">45</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Source ID</td><td width="80%">1</td>
|
|
</tr>
|
|
|
|
</table>
|
|
<div class="spacer"></div>
|
|
<table width="100%" class="results">
|
|
|
|
|
|
|
|
<tr height="24" class="risk-medium">
|
|
<th width="20%"><a name="medium"></a>Medium (Medium)</th><th width="80%">X-Frame-Options Header Not Set</th>
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Description</td><td width="80%"><p>X-Frame-Options header is not included in the HTTP response to protect against 'ClickJacking' attacks.</p></td>
|
|
</tr>
|
|
<TR vAlign="top">
|
|
<TD colspan="2"></TD>
|
|
</TR>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Parameter</td><td width="80%">X-Frame-Options</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Parameter</td><td width="80%">X-Frame-Options</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Instances</td><td width="80%">2</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Solution</td><td width="80%"><p>Most modern Web browsers support the X-Frame-Options HTTP header. Ensure it's set on all web pages returned by your site (if you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. ALLOW-FROM allows specific websites to frame the web page in supported web browsers).</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Reference</td><td width="80%"><p>https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">CWE Id</td><td width="80%">16</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">WASC Id</td><td width="80%">15</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Source ID</td><td width="80%">3</td>
|
|
</tr>
|
|
|
|
</table>
|
|
<div class="spacer"></div>
|
|
<table width="100%" class="results">
|
|
|
|
|
|
|
|
<tr height="24" class="risk-low">
|
|
<a name="low"></a><th width="20%">Low (High)</th><th width="80%">Strict-Transport-Security Header Not Set</th>
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Description</td><td width="80%"><p>HTTP Strict Transport Security (HSTS) is a web security policy mechanism whereby a web server declares that complying user agents (such as a web browser) are to interact with it using only secure HTTPS connections (i.e. HTTP layered over TLS/SSL). HSTS is an IETF standards track protocol and is specified in RFC 6797.</p></td>
|
|
</tr>
|
|
<TR vAlign="top">
|
|
<TD colspan="2"></TD>
|
|
</TR>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/robots.txt</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/sitemap.xml</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Instances</td><td width="80%">4</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Solution</td><td width="80%"><p>Ensure that your web server, application server, load balancer, etc. is configured to enforce Strict-Transport-Security.</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Reference</td><td width="80%"><p>https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html</p><p>https://owasp.org/www-community/Security_Headers</p><p>http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security</p><p>http://caniuse.com/stricttransportsecurity</p><p>http://tools.ietf.org/html/rfc6797</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">CWE Id</td><td width="80%">16</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">WASC Id</td><td width="80%">15</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Source ID</td><td width="80%">3</td>
|
|
</tr>
|
|
|
|
</table>
|
|
<div class="spacer"></div>
|
|
<table width="100%" class="results">
|
|
|
|
|
|
|
|
<tr height="24" class="risk-low">
|
|
<a name="low"></a><th width="20%">Low (High)</th><th width="80%">Server Leaks Version Information via "Server" HTTP Response Header Field</th>
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Description</td><td width="80%"><p>The web/application server is leaking version information via the "Server" HTTP response header. Access to such information may facilitate attackers identifying other vulnerabilities your web/application server is subject to.</p></td>
|
|
</tr>
|
|
<TR vAlign="top">
|
|
<TD colspan="2"></TD>
|
|
</TR>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Evidence</td><td width="80%">Apache/2.4.37 (centos) OpenSSL/1.1.1c</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/sitemap.xml</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Evidence</td><td width="80%">Apache/2.4.37 (centos) OpenSSL/1.1.1c</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Evidence</td><td width="80%">Apache/2.4.37 (centos) OpenSSL/1.1.1c</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/robots.txt</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Evidence</td><td width="80%">Apache/2.4.37 (centos) OpenSSL/1.1.1c</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Instances</td><td width="80%">4</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Solution</td><td width="80%"><p>Ensure that your web server, application server, load balancer, etc. is configured to suppress the "Server" header or provide generic details.</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Reference</td><td width="80%"><p>http://httpd.apache.org/docs/current/mod/core.html#servertokens</p><p>http://msdn.microsoft.com/en-us/library/ff648552.aspx#ht_urlscan_007</p><p>http://blogs.msdn.com/b/varunm/archive/2013/04/23/remove-unwanted-http-response-headers.aspx</p><p>http://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">CWE Id</td><td width="80%">200</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">WASC Id</td><td width="80%">13</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Source ID</td><td width="80%">3</td>
|
|
</tr>
|
|
|
|
</table>
|
|
<div class="spacer"></div>
|
|
<table width="100%" class="results">
|
|
|
|
|
|
|
|
<tr height="24" class="risk-low">
|
|
<a name="low"></a><th width="20%">Low (Medium)</th><th width="80%">X-Content-Type-Options Header Missing</th>
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Description</td><td width="80%"><p>The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.</p></td>
|
|
</tr>
|
|
<TR vAlign="top">
|
|
<TD colspan="2"></TD>
|
|
</TR>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/robots.txt</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Parameter</td><td width="80%">X-Content-Type-Options</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Parameter</td><td width="80%">X-Content-Type-Options</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Parameter</td><td width="80%">X-Content-Type-Options</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Instances</td><td width="80%">3</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Solution</td><td width="80%"><p>Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.</p><p>If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Other information</td><td width="80%"><p>This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.</p><p>At "High" threshold this scan rule will not alert on client or server error responses.</p></td>
|
|
</tr>
|
|
<TR vAlign="top">
|
|
<TD colspan="2"></TD>
|
|
</TR>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Reference</td><td width="80%"><p>http://msdn.microsoft.com/en-us/library/ie/gg622941%28v=vs.85%29.aspx</p><p>https://owasp.org/www-community/Security_Headers</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">CWE Id</td><td width="80%">16</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">WASC Id</td><td width="80%">15</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Source ID</td><td width="80%">3</td>
|
|
</tr>
|
|
|
|
</table>
|
|
<div class="spacer"></div>
|
|
<table width="100%" class="results">
|
|
|
|
|
|
|
|
<tr height="24" class="risk-low">
|
|
<a name="low"></a><th width="20%">Low (Medium)</th><th width="80%">Insufficient Site Isolation Against Spectre Vulnerability</th>
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Description</td><td width="80%"><p>Cross-Origin-Embedder-Policy header is a response header that prevents a document from loading any cross-origin resources that don't explicitly grant the document permission (using CORP or CORS).</p></td>
|
|
</tr>
|
|
<TR vAlign="top">
|
|
<TD colspan="2"></TD>
|
|
</TR>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Parameter</td><td width="80%">Cross-Origin-Embedder-Policy</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Parameter</td><td width="80%">Cross-Origin-Opener-Policy</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Parameter</td><td width="80%">Cross-Origin-Opener-Policy</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/robots.txt</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Parameter</td><td width="80%">Cross-Origin-Resource-Policy</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Parameter</td><td width="80%">Cross-Origin-Resource-Policy</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Parameter</td><td width="80%">Cross-Origin-Embedder-Policy</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Parameter</td><td width="80%">Cross-Origin-Resource-Policy</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Instances</td><td width="80%">7</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Solution</td><td width="80%"><p>Ensure that the application/web server sets the Cross-Origin-Embedder-Policy header appropriately, and that it sets the Cross-Origin-Embedder-Policy header to 'require-corp' for documents.</p><p>If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Embedder-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-embedder-policy).</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Reference</td><td width="80%"><p>https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">CWE Id</td><td width="80%">16</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">WASC Id</td><td width="80%">14</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Source ID</td><td width="80%">3</td>
|
|
</tr>
|
|
|
|
</table>
|
|
<div class="spacer"></div>
|
|
<table width="100%" class="results">
|
|
|
|
|
|
|
|
<tr height="24" class="risk-low">
|
|
<a name="low"></a><th width="20%">Low (Medium)</th><th width="80%">Feature Policy Header Not Set</th>
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Description</td><td width="80%"><p>Feature Policy Header is an added layer of security that helps to restrict from unauthorized access or usage of browser/client features by web resources. This policy ensures the user privacy by limiting or specifying the features of the browsers can be used by the web resources. Feature Policy provides a set of standard HTTP headers that allow website owners to limit which features of browsers can be used by the page such as camera, microphone, location, full screen etc.</p></td>
|
|
</tr>
|
|
<TR vAlign="top">
|
|
<TD colspan="2"></TD>
|
|
</TR>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/sitemap.xml</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Instances</td><td width="80%">3</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Solution</td><td width="80%"><p>Ensure that your web server, application server, load balancer, etc. is configured to set the Feature-Policy header.</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Reference</td><td width="80%"><p>https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy</p><p>https://developers.google.com/web/updates/2018/06/feature-policy</p><p>https://scotthelme.co.uk/a-new-security-header-feature-policy/</p><p>https://w3c.github.io/webappsec-feature-policy/</p><p>https://www.smashingmagazine.com/2018/12/feature-policy/</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">CWE Id</td><td width="80%">16</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">WASC Id</td><td width="80%">15</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Source ID</td><td width="80%">3</td>
|
|
</tr>
|
|
|
|
</table>
|
|
<div class="spacer"></div>
|
|
<table width="100%" class="results">
|
|
|
|
|
|
|
|
<tr height="24" class="risk-info">
|
|
<th width="20%"><a name="info"></a>Informational (Medium)</th><th width="80%">Modern Web Application</th>
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Description</td><td width="80%"><p>The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.</p></td>
|
|
</tr>
|
|
<TR vAlign="top">
|
|
<TD colspan="2"></TD>
|
|
</TR>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Evidence</td><td width="80%"><script>!function(e){function r(r){for(var n,l,a=r[0],p=r[1],f=r[2],c=0,s=[];c<a.length;c++)l=a[c],Object.prototype.hasOwnProperty.call(o,l)&&o[l]&&s.push(o[l][0]),o[l]=0;for(n in p)Object.prototype.hasOwnProperty.call(p,n)&&(e[n]=p[n]);for(i&&i(r);s.length;)s.shift()();return u.push.apply(u,f||[]),t()}function t(){for(var e,r=0;r<u.length;r++){for(var t=u[r],n=!0,a=1;a<t.length;a++){var p=t[a];0!==o[p]&&(n=!1)}n&&(u.splice(r--,1),e=l(l.s=t[0]))}return e}var n={},o={1:0},u=[];function l(r){if(n[r])return n[r].exports;var t=n[r]={i:r,l:!1,exports:{}};return e[r].call(t.exports,t,t.exports,l),t.l=!0,t.exports}l.m=e,l.c=n,l.d=function(e,r,t){l.o(e,r)||Object.defineProperty(e,r,{enumerable:!0,get:t})},l.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},l.t=function(e,r){if(1&r&&(e=l(e)),8&r)return e;if(4&r&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(l.r(t),Object.defineProperty(t,"default",{enumerable:!0,value:e}),2&r&&"string"!=typeof e)for(var n in e)l.d(t,n,function(r){return e[r]}.bind(null,n));return t},l.n=function(e){var r=e&&e.__esModule?function(){return e.default}:function(){return e};return l.d(r,"a",r),r},l.o=function(e,r){return Object.prototype.hasOwnProperty.call(e,r)},l.p="/";var a=this.webpackJsonpplannaplan=this.webpackJsonpplannaplan||[],p=a.push.bind(a);a.push=r,a=a.slice();for(var f=0;f<a.length;f++)r(a[f]);var i=p;t()}([])</script></td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Evidence</td><td width="80%"><script>!function(e){function r(r){for(var n,l,a=r[0],p=r[1],f=r[2],c=0,s=[];c<a.length;c++)l=a[c],Object.prototype.hasOwnProperty.call(o,l)&&o[l]&&s.push(o[l][0]),o[l]=0;for(n in p)Object.prototype.hasOwnProperty.call(p,n)&&(e[n]=p[n]);for(i&&i(r);s.length;)s.shift()();return u.push.apply(u,f||[]),t()}function t(){for(var e,r=0;r<u.length;r++){for(var t=u[r],n=!0,a=1;a<t.length;a++){var p=t[a];0!==o[p]&&(n=!1)}n&&(u.splice(r--,1),e=l(l.s=t[0]))}return e}var n={},o={1:0},u=[];function l(r){if(n[r])return n[r].exports;var t=n[r]={i:r,l:!1,exports:{}};return e[r].call(t.exports,t,t.exports,l),t.l=!0,t.exports}l.m=e,l.c=n,l.d=function(e,r,t){l.o(e,r)||Object.defineProperty(e,r,{enumerable:!0,get:t})},l.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},l.t=function(e,r){if(1&r&&(e=l(e)),8&r)return e;if(4&r&&"object"==typeof e&&e&&e.__esModule)return e;var t=Object.create(null);if(l.r(t),Object.defineProperty(t,"default",{enumerable:!0,value:e}),2&r&&"string"!=typeof e)for(var n in e)l.d(t,n,function(r){return e[r]}.bind(null,n));return t},l.n=function(e){var r=e&&e.__esModule?function(){return e.default}:function(){return e};return l.d(r,"a",r),r},l.o=function(e,r){return Object.prototype.hasOwnProperty.call(e,r)},l.p="/";var a=this.webpackJsonpplannaplan=this.webpackJsonpplannaplan||[],p=a.push.bind(a);a.push=r,a=a.slice();for(var f=0;f<a.length;f++)r(a[f]);var i=p;t()}([])</script></td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Instances</td><td width="80%">2</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Solution</td><td width="80%"><p>This is an informational alert and so no changes are required.</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Other information</td><td width="80%"><p>No links have been found while there are scripts, which is an indication that this is a modern web application.</p></td>
|
|
</tr>
|
|
<TR vAlign="top">
|
|
<TD colspan="2"></TD>
|
|
</TR>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Reference</td><td width="80%"><p></p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Source ID</td><td width="80%">3</td>
|
|
</tr>
|
|
|
|
</table>
|
|
<div class="spacer"></div>
|
|
<table width="100%" class="results">
|
|
|
|
|
|
|
|
<tr height="24" class="risk-info">
|
|
<th width="20%"><a name="info"></a>Informational (Medium)</th><th width="80%">Non-Storable Content</th>
|
|
</tr>
|
|
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Description</td><td width="80%"><p>The response contents are not storable by caching components such as proxy servers. If the response does not contain sensitive, personal or user-specific information, it may benefit from being stored and cached, to improve performance.</p></td>
|
|
</tr>
|
|
<TR vAlign="top">
|
|
<TD colspan="2"></TD>
|
|
</TR>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Evidence</td><td width="80%">no-store</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Evidence</td><td width="80%">no-store</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/sitemap.xml</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Evidence</td><td width="80%">no-store</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent1">URL</td><td width="80%">https://wmi.plannaplan.pl/robots.txt</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Method</td><td width="80%">GET</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%" class="indent2">Evidence</td><td width="80%">no-store</td>
|
|
</tr>
|
|
|
|
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Instances</td><td width="80%">4</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Solution</td><td width="80%"><p>The content may be marked as storable by ensuring that the following conditions are satisfied:</p><p>The request method must be understood by the cache and defined as being cacheable ("GET", "HEAD", and "POST" are currently defined as cacheable)</p><p>The response status code must be understood by the cache (one of the 1XX, 2XX, 3XX, 4XX, or 5XX response classes are generally understood)</p><p>The "no-store" cache directive must not appear in the request or response header fields</p><p>For caching by "shared" caches such as "proxy" caches, the "private" response directive must not appear in the response</p><p>For caching by "shared" caches such as "proxy" caches, the "Authorization" header field must not appear in the request, unless the response explicitly allows it (using one of the "must-revalidate", "public", or "s-maxage" Cache-Control response directives)</p><p>In addition to the conditions above, at least one of the following conditions must also be satisfied by the response:</p><p>It must contain an "Expires" header field</p><p>It must contain a "max-age" response directive</p><p>For "shared" caches such as "proxy" caches, it must contain a "s-maxage" response directive</p><p>It must contain a "Cache Control Extension" that allows it to be cached</p><p>It must have a status code that is defined as cacheable by default (200, 203, 204, 206, 300, 301, 404, 405, 410, 414, 501). </p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Reference</td><td width="80%"><p>https://tools.ietf.org/html/rfc7234</p><p>https://tools.ietf.org/html/rfc7231</p><p>http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html (obsoleted by rfc7234)</p></td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">CWE Id</td><td width="80%">524</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">WASC Id</td><td width="80%">13</td>
|
|
</tr>
|
|
|
|
<tr bgcolor="#e8e8e8">
|
|
<td width="20%">Source ID</td><td width="80%">3</td>
|
|
</tr>
|
|
|
|
</table>
|
|
</body>
|
|
</html>
|