From 0a715ea812b405ba96e3d7cd30f700f4c6032d2b Mon Sep 17 00:00:00 2001 From: vijaivir Date: Thu, 8 Feb 2024 15:59:14 +0000 Subject: [PATCH] =?UTF-8?q?Deploying=20to=20zap-scan=20from=20@=20bcgov/co?= =?UTF-8?q?mmon-hosted-form-service@d063db06146d7322732a019de190b00cc9fb93?= =?UTF-8?q?a2=20=F0=9F=9A=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- report_html.html | 2376 +++++++++++++++++++++++++++++++++++++++------- report_json.json | 518 +++++++++- report_md.md | 632 +++++++++++- 3 files changed, 3127 insertions(+), 399 deletions(-) diff --git a/report_html.html b/report_html.html index 6e6121389..a74887d10 100644 --- a/report_html.html +++ b/report_html.html @@ -127,7 +127,7 @@

- Generated on Wed, 7 Feb 2024 19:48:22 + Generated on Thu, 8 Feb 2024 15:59:10

@@ -156,7 +156,7 @@

Summary of Alerts

Medium
-
1
+
4
@@ -164,7 +164,7 @@

Summary of Alerts

Low
-
2
+
5
@@ -172,7 +172,7 @@

Summary of Alerts

Informational
-
5
+
11
@@ -197,45 +197,105 @@

Alerts

Number of Instances + + CSP: Wildcard Directive + Medium + 1 + Content Security Policy (CSP) Header Not Set Medium 4 + + Missing Anti-clickjacking Header + Medium + 1 + + + Proxy Disclosure + Medium + 2 + + + Cookie with SameSite Attribute None + Low + 1 + Permissions Policy Header Not Set Low 4 + + Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) + Low + 2 + Strict-Transport-Security Header Not Set Low 4 + + X-Content-Type-Options Header Missing + Low + 1 + + + Cookie Slack Detector + Informational + 2 + + + Modern Web Application + Informational + 1 + Non-Storable Content Informational 4 + + Re-examine Cache-control Directives + Informational + 1 + Sec-Fetch-Dest Header is Missing Informational - 3 + 4 Sec-Fetch-Mode Header is Missing Informational - 3 + 4 Sec-Fetch-Site Header is Missing Informational - 3 + 4 Sec-Fetch-User Header is Missing Informational - 3 + 4 + + + Session Management Response Identified + Informational + 1 + + + Storable but Non-Cacheable Content + Informational + 1 + + + User Agent Fuzzer + Informational + 12
@@ -244,6 +304,105 @@

Alerts

Alert Detail

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Medium
CSP: Wildcard Directive
Description +
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.
+ +
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
MethodGET
Parametercontent-security-policy
Attack
Evidencedefault-src 'none'
Other InfoThe following directives either allow wildcard sources (or ancestors), are not defined, or are overly broadly defined: +frame-ancestors, form-action + +The directive(s): frame-ancestors, form-action are among the directives that do not fallback to default-src, missing/excluding them is the same as allowing anything.
Instances1
Solution +
Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
+ +
Reference + https://www.w3.org/TR/CSP/ +
+ + https://caniuse.com/#search=content+security+policy +
+ + https://content-security-policy.com/ +
+ + https://github.com/HtmlUnit/htmlunit-csp +
+ + https://developers.google.com/web/fundamentals/security/csp#policy_applies_to_a_wide_variety_of_resources + +
CWE Id693
WASC Id15
Plugin Id10055
+
+ - +
Alert Detail
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/
Alert Detail - - + + @@ -460,7 +619,7 @@

Alert Detail

- + - + - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + +
-
Low
Permissions Policy Header Not Set +
Medium
Missing Anti-clickjacking Header
Description -
Permissions Policy Header is an added layer of security that helps to restrict from unauthorized access or usage of browser/client features by web resources. This policy ensures the user privacy by limiting or specifying the features of the browsers can be used by the web resources. Permissions Policy provides a set of standard HTTP headers that allow website owners to limit which features of browsers can be used by the page such as camera, microphone, location, full screen etc.
+
The response does not include either Content-Security-Policy with 'frame-ancestors' directive or X-Frame-Options to protect against 'ClickJacking' attacks.
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/
Alert Detail
Parameterx-frame-options
Alert Detail
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275
MethodGET
Parameter
Attack
Evidence
Other Info
Instances1
Solution +
Modern Web browsers support the Content-Security-Policy and X-Frame-Options HTTP headers. Ensure one of them is set on all web pages returned by your site/app.
+
+ +
If you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. Alternatively consider implementing Content Security Policy's "frame-ancestors" directive.
+ +
Reference + https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options + +
CWE Id1021
WASC Id15
Plugin Id10020
+
+ + + + + + + + + + + + + - + - + - + - + - + - + - + - - - - + + + + + href="https://cwe.mitre.org/data/definitions/200.html">200 - + + href="https://www.zaproxy.org/docs/alerts/40025/">40025
+
Medium
Proxy Disclosure
Description +
1 proxy server(s) were detected or fingerprinted. This information helps a potential attacker to determine
+
+ +
- A list of targets for an attack against the application.
+
+ +
- Potential vulnerabilities on the proxy servers that service the application.
+
+ +
- The presence or absence of any proxy-based components that might cause attacks against the application to be detected, prevented, or mitigated.
+ +
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txthttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
Alert Detail
AttackTRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.
Alert Detail
Other InfoUsing the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +The following web/application server has been identified: +- [Express] +
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/sitemap.xmlhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/
Alert Detail
AttackTRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.
Alert Detail
Other InfoUsing the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +The following web/application server has been identified: +- [Express] +
Instances42
Solution -
Ensure that your web server, application server, load balancer, etc. is configured to set the Permissions-Policy header.
- -
Reference - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy -
- - https://developer.chrome.com/blog/feature-policy/ +
Disable the 'TRACE' method on the proxy servers, as well as the origin web/application server.

- https://scotthelme.co.uk/a-new-security-header-feature-policy/ +
Disable the 'OPTIONS' method on the proxy servers, as well as the origin web/application server, if it is not required for other purposes, such as 'CORS' (Cross Origin Resource Sharing).

- https://w3c.github.io/webappsec-feature-policy/ +
Configure the web and application servers with custom error pages, to prevent 'fingerprintable' product-specific error pages being leaked to the user in the event of HTTP errors, such as 'TRACK' requests for non-existent pages.

- https://www.smashingmagazine.com/2018/12/feature-policy/ +
Configure all proxies, application servers, and web servers to prevent disclosure of the technology and version information in the 'Server' and 'X-Powered-By' HTTP response headers.
+ +
Reference + https://tools.ietf.org/html/rfc7231#section-5.1.2
CWE Id 693
WASC Id1545
Plugin Id 10063
@@ -631,14 +829,14 @@

Alert Detail

- + @@ -649,7 +847,7 @@

Alert Detail

- + - + - + - - - - + + + + + + + + + + + + + + + + + + + + + + + + +
+ id="10054">
Low
Strict-Transport-Security Header Not SetCookie with SameSite Attribute None
Description -
HTTP Strict Transport Security (HSTS) is a web security policy mechanism whereby a web server declares that complying user agents (such as a web browser) are to interact with it using only secure HTTPS connections (i.e. HTTP layered over TLS/SSL). HSTS is an IETF standards track protocol and is specified in RFC 6797.
+
A cookie has been set with its SameSite attribute set to "none", which means that the cookie can be sent as a result of a 'cross-site' request. The SameSite attribute is an effective counter measure to cross-site request forgery, cross-site script inclusion, and timing attacks.
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
Alert Detail
Parametereed6a67d093ebd7ab21b438a506ffb35
Alert Detail
Evidenceset-cookie: eed6a67d093ebd7ab21b438a506ffb35
Alert Detail
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275
Instances1
Solution +
Ensure that the SameSite attribute is set to either 'lax' or ideally 'strict' for all cookies.
+ +
Reference + https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site + +
CWE Id1275
WASC Id13
Plugin Id10054
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -777,33 +1059,33 @@

Alert Detail

+ href="https://cwe.mitre.org/data/definitions/693.html">693 @@ -812,22 +1094,140 @@

Alert Detail

+ href="https://www.zaproxy.org/docs/alerts/10063/">10063
+
Low
Permissions Policy Header Not Set
Description +
Permissions Policy Header is an added layer of security that helps to restrict from unauthorized access or usage of browser/client features by web resources. This policy ensures the user privacy by limiting or specifying the features of the browsers can be used by the web resources. Permissions Policy provides a set of standard HTTP headers that allow website owners to limit which features of browsers can be used by the page such as camera, microphone, location, full screen etc.
+ +
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/
MethodGET
Parameter
Attack
Evidence
Other Info
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/
Method
Solution -
Ensure that your web server, application server, load balancer, etc. is configured to enforce Strict-Transport-Security.
+
Ensure that your web server, application server, load balancer, etc. is configured to set the Permissions-Policy header.
Reference - https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html + https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy
- https://owasp.org/www-community/Security_Headers + https://developer.chrome.com/blog/feature-policy/
- https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security + https://scotthelme.co.uk/a-new-security-header-feature-policy/
- https://caniuse.com/stricttransportsecurity + https://w3c.github.io/webappsec-feature-policy/
- https://datatracker.ietf.org/doc/html/rfc6797 + https://www.smashingmagazine.com/2018/12/feature-policy/
CWE Id 319
WASC Id
Plugin Id 10035
- - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
-
Informational
Non-Storable Content +
Low
Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s)
Description -
The response contents are not storable by caching components such as proxy servers. If the response does not contain sensitive, personal or user-specific information, it may benefit from being stored and cached, to improve performance.
+
The web/application server is leaking information via one or more "X-Powered-By" HTTP response headers. Access to such information may facilitate attackers identifying other frameworks/components your web application is reliant upon and the vulnerabilities such components may be subject to.
+ +
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
MethodGET
Parameter
Attack
Evidencex-powered-by: Express
Other Info
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/
MethodGET
Parameter
Attack
Evidencex-powered-by: Express
Other Info
Instances2
Solution +
Ensure that your web server, application server, load balancer, etc. is configured to suppress "X-Powered-By" headers.
+ +
Reference + https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/01-Information_Gathering/08-Fingerprint_Web_Application_Framework +
+ + https://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html + +
CWE Id200
WASC Id13
Plugin Id10037
+
+ + + + + + + + + @@ -858,7 +1258,7 @@

Alert Detail

- + - + - + - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Low
Strict-Transport-Security Header Not Set
Description +
HTTP Strict Transport Security (HSTS) is a web security policy mechanism whereby a web server declares that complying user agents (such as a web browser) are to interact with it using only secure HTTPS connections (i.e. HTTP layered over TLS/SSL). HSTS is an IETF standards track protocol and is specified in RFC 6797.
Evidenceno-store
Alert Detail
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/
Alert Detail
Evidenceno-store
Alert Detail
Evidenceno-store
Other Info
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/sitemap.xml
MethodGET
Parameter
Attack
Evidence
Alert Detail
Instances4
Solution +
Ensure that your web server, application server, load balancer, etc. is configured to enforce Strict-Transport-Security.
+ +
Reference + https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html +
+ + https://owasp.org/www-community/Security_Headers +
+ + https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security +
+ + https://caniuse.com/stricttransportsecurity +
+ + https://datatracker.ietf.org/doc/html/rfc6797 + +
CWE Id319
WASC Id15
Plugin Id10035
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Low
X-Content-Type-Options Header Missing
Description +
The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.
+ +
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/
MethodGET
Parameterx-content-type-options
Attack
Evidence
Other InfoThis issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type. +At "High" threshold this scan rule will not alert on client or server error responses.
Instances1
Solution +
Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.
+
+ +
If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.
+ +
Reference + https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/compatibility/gg622941(v=vs.85) +
+ + https://owasp.org/www-community/Security_Headers + +
CWE Id693
WASC Id15
Plugin Id10021
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Informational
Cookie Slack Detector
Description +
Repeated GET requests: drop a different cookie each time, followed by normal request with all cookies to stabilize session, compare responses against original baseline GET. This can reveal areas where cookie based authentication/attributes are not actually enforced.
+ +
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
MethodGET
Parameter
Attack
Evidence
Other InfoCookies that don't have expected effects can reveal flaws in application logic. In the worst case, this can reveal where authentication via cookie token(s) is not actually enforced. +These cookies affected the response: +These cookies did NOT affect the response: eed6a67d093ebd7ab21b438a506ffb35 +
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/
MethodGET
Parameter
Attack
Evidence
Other InfoCookies that don't have expected effects can reveal flaws in application logic. In the worst case, this can reveal where authentication via cookie token(s) is not actually enforced. +These cookies affected the response: +These cookies did NOT affect the response: eed6a67d093ebd7ab21b438a506ffb35 +
Instances2
Solution
Reference + https://cwe.mitre.org/data/definitions/205.html + +
CWE Id200
WASC Id45
Plugin Id90027
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Informational
Modern Web Application
Description +
The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.
+ +
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/
MethodGET
Parameter
Attack
Evidence<script type="module" crossorigin src="/pr-1253/assets/index-abc27496.js"></script>
Other InfoNo links have been found while there are scripts, which is an indication that this is a modern web application.
Instances1
Solution +
This is an informational alert and so no changes are required.
+ +
Reference
CWE Id
WASC Id
Plugin Id10109
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Informational
Non-Storable Content
Description +
The response contents are not storable by caching components such as proxy servers. If the response does not contain sensitive, personal or user-specific information, it may benefit from being stored and cached, to improve performance.
+ +
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/
MethodGET
Parameter
Attack
Evidenceno-store
Other Info
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
MethodGET
Parameter
Attack
Evidenceprivate
Other Info
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt
MethodGET
Parameter
Attack
Evidenceno-store
Other Info
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/sitemap.xml
MethodGET
Parameter
Attack
Evidenceno-store
Other Info
Instances4
Solution +
The content may be marked as storable by ensuring that the following conditions are satisfied:
+
+ +
The request method must be understood by the cache and defined as being cacheable ("GET", "HEAD", and "POST" are currently defined as cacheable)
+
+ +
The response status code must be understood by the cache (one of the 1XX, 2XX, 3XX, 4XX, or 5XX response classes are generally understood)
+
+ +
The "no-store" cache directive must not appear in the request or response header fields
+
+ +
For caching by "shared" caches such as "proxy" caches, the "private" response directive must not appear in the response
+
+ +
For caching by "shared" caches such as "proxy" caches, the "Authorization" header field must not appear in the request, unless the response explicitly allows it (using one of the "must-revalidate", "public", or "s-maxage" Cache-Control response directives)
+
+ +
In addition to the conditions above, at least one of the following conditions must also be satisfied by the response:
+
+ +
It must contain an "Expires" header field
+
+ +
It must contain a "max-age" response directive
+
+ +
For "shared" caches such as "proxy" caches, it must contain a "s-maxage" response directive
+
+ +
It must contain a "Cache Control Extension" that allows it to be cached
+
+ +
It must have a status code that is defined as cacheable by default (200, 203, 204, 206, 300, 301, 404, 405, 410, 414, 501).
+ +
Reference + https://datatracker.ietf.org/doc/html/rfc7234 +
+ + https://datatracker.ietf.org/doc/html/rfc7231 +
+ + https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html + +
CWE Id524
WASC Id13
Plugin Id10049
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Informational
Re-examine Cache-control Directives
Description +
The cache-control header has not been set properly or is missing, allowing the browser and proxies to cache content. For static assets like css, js, or image files this might be intended, however, the resources should be reviewed to ensure that no sensitive content will be cached.
+ +
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/
MethodGET
Parametercache-control
Attack
Evidencepublic, max-age=0
Other Info
Instances1
Solution +
For secure content, ensure the cache-control HTTP header is set with "no-cache, no-store, must-revalidate". If an asset should be cached consider setting the directives "public, max-age, immutable".
+ +
Reference + https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#web-content-caching +
+ + https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control +
+ + https://grayduck.mn/2021/09/13/cache-control-recommendations/ + +
CWE Id525
WASC Id13
Plugin Id10015
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Informational
Sec-Fetch-Dest Header is Missing
Description +
Specifies how and where the data would be used. For instance, if the value is audio, then the requested resource must be audio data and not any other type of resource.
+ +
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/
MethodGET
ParameterSec-Fetch-Dest
Attack
Evidence
Other Info
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
MethodGET
ParameterSec-Fetch-Dest
Attack
Evidence
Other Info
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/
MethodGET
ParameterSec-Fetch-Dest
Attack
Evidence
Other Info
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt
MethodGET
ParameterSec-Fetch-Dest
Attack
Evidence
Other Info
Instances4
Solution +
Ensure that Sec-Fetch-Dest header is included in request headers.
+ +
Reference + https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Dest + +
CWE Id352
WASC Id9
Plugin Id90005
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Informational
Sec-Fetch-Mode Header is Missing
Description +
Allows to differentiate between requests for navigating between HTML pages and requests for loading resources like images, audio etc.
+ +
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/
MethodGET
ParameterSec-Fetch-Mode
Attack
Evidence
Other Info
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
MethodGET
ParameterSec-Fetch-Mode
Attack
Evidence
Other Info
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/
MethodGET
ParameterSec-Fetch-Mode
Attack
Evidence
Other Info
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt
MethodGET
ParameterSec-Fetch-Mode
Attack
Evidence
Other Info
Instances4
Solution +
Ensure that Sec-Fetch-Mode header is included in request headers.
+ +
Reference + https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Mode + +
CWE Id352
WASC Id9
Plugin Id90005
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Informational
Sec-Fetch-Site Header is Missing
Description +
Specifies the relationship between request initiator's origin and target's origin.
+ +
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/
MethodGET
ParameterSec-Fetch-Site
Attack
Evidence
Other Info
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
MethodGET
ParameterSec-Fetch-Site
Attack
Evidence
Other Info
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/
MethodGET
ParameterSec-Fetch-Site
Attack
Evidence
Other Info
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt
MethodGET
ParameterSec-Fetch-Site
Attack
Evidence
Other Info
Instances4
Solution +
Ensure that Sec-Fetch-Site header is included in request headers.
+ +
Reference + https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Site + +
CWE Id352
WASC Id9
Plugin Id90005
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Informational
Sec-Fetch-User Header is Missing
Description +
Specifies if a navigation request was initiated by a user.
+ +
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/
MethodGET
ParameterSec-Fetch-User
Attack
Evidence
Other Info
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
MethodGET
ParameterSec-Fetch-User
Attack
Evidence
Other Info
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/
MethodGET
ParameterSec-Fetch-User
Attack
Evidence
Other Info
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt
MethodGET
ParameterSec-Fetch-User
Attack
Evidence
Other Info
Instances4
Solution +
Ensure that Sec-Fetch-User header is included in user initiated requests.
+ +
Reference + https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-User + +
CWE Id352
WASC Id9
Plugin Id90005
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
Informational
Session Management Response Identified
Description +
The given response has been identified as containing a session management token. The 'Other Info' field contains a set of header tokens that can be used in the Header Based Session Management Method. If the request is in a context which has a Session Management Method set to "Auto-Detect" then this rule will change the session management to use the tokens identified.
+ +
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
MethodGET
Parametereed6a67d093ebd7ab21b438a506ffb35
Attack
Evidence0638612519a4a4e878d1de05d5624c14
Other Info +cookie:eed6a67d093ebd7ab21b438a506ffb35
Instances1
Solution +
This is an informational alert rather than a vulnerability and so there is nothing to fix.
+ +
Reference + https://www.zaproxy.org/docs/desktop/addons/authentication-helper/session-mgmt-id + +
CWE Id
WASC Id
Plugin Id10112
+
+ + + + + + + + + + + + + + - + - + - + - + @@ -1036,14 +2883,14 @@

Alert Detail

+
Informational
Storable but Non-Cacheable Content
Description +
The response contents are storable by caching components such as proxy servers, but will not be retrieved directly from the cache, without validating the request upstream, in response to similar requests from other users.
+ +
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/sitemap.xmlhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/
Alert Detail
Evidenceno-storemax-age=0
Alert Detail
Instances41
Solution -
The content may be marked as storable by ensuring that the following conditions are satisfied:
-
- -
The request method must be understood by the cache and defined as being cacheable ("GET", "HEAD", and "POST" are currently defined as cacheable)
-
- -
The response status code must be understood by the cache (one of the 1XX, 2XX, 3XX, 4XX, or 5XX response classes are generally understood)
-
- -
The "no-store" cache directive must not appear in the request or response header fields
-
- -
For caching by "shared" caches such as "proxy" caches, the "private" response directive must not appear in the response
-
- -
For caching by "shared" caches such as "proxy" caches, the "Authorization" header field must not appear in the request, unless the response explicitly allows it (using one of the "must-revalidate", "public", or "s-maxage" Cache-Control response directives)
-
- -
In addition to the conditions above, at least one of the following conditions must also be satisfied by the response:
-
- -
It must contain an "Expires" header field
-
- -
It must contain a "max-age" response directive
-
- -
For "shared" caches such as "proxy" caches, it must contain a "s-maxage" response directive
-
- -
It must contain a "Cache Control Extension" that allows it to be cached
-
- -
It must have a status code that is defined as cacheable by default (200, 203, 204, 206, 300, 301, 404, 405, 410, 414, 501).
- -
Reference
- + @@ -1054,7 +2901,7 @@

Alert Detail

- + - + - + - + - + - + - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - -
+ id="10104">
Informational
Sec-Fetch-Dest Header is MissingUser Agent Fuzzer
Description -
Specifies how and where the data would be used. For instance, if the value is audio, then the requested resource must be audio data and not any other type of resource.
+
Check for differences in response based on fuzzed User Agent (eg. mobile sites, access as a Search Engine Crawler). Compares the response statuscode and the hashcode of the response body with the original response.
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
Alert Detail
ParameterSec-Fetch-DestHeader User-Agent
AttackMozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Alert Detail
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txthttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
Alert Detail
ParameterSec-Fetch-DestHeader User-Agent
AttackMozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Alert Detail
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/sitemap.xmlhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
Alert Detail
ParameterSec-Fetch-DestHeader User-Agent
AttackMozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)
Alert Detail
Instances3
Solution -
Ensure that Sec-Fetch-Dest header is included in request headers.
- -
Reference - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Dest - -
CWE Id352
WASC Id9
Plugin Id90005
-
- - - - - - - - - - - - - - - + - + - + - + - + - + - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - -
-
Informational
Sec-Fetch-Mode Header is Missing
Description -
Allows to differentiate between requests for navigating between HTML pages and requests for loading resources like images, audio etc.
- -
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
Alert Detail
ParameterSec-Fetch-ModeHeader User-Agent
AttackMozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko
Alert Detail
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txthttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
Alert Detail
ParameterSec-Fetch-ModeHeader User-Agent
AttackMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0
Alert Detail
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/sitemap.xmlhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
Alert Detail
ParameterSec-Fetch-ModeHeader User-Agent
AttackMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
Alert Detail
Instances3
Solution -
Ensure that Sec-Fetch-Mode header is included in request headers.
- -
Reference - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Mode - -
CWE Id352
WASC Id9
Plugin Id90005
-
- - - - - - - - - - - - - - - + - + - + - + - + - + - + - + - + - - - - - - - - - - - - - - - - - - - - - - - - -
-
Informational
Sec-Fetch-Site Header is Missing
Description -
Specifies the relationship between request initiator's origin and target's origin.
- -
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
Alert Detail
ParameterSec-Fetch-SiteHeader User-Agent
AttackMozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/91.0
Alert Detail
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txthttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
Alert Detail
ParameterSec-Fetch-SiteHeader User-Agent
AttackMozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Alert Detail
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/sitemap.xmlhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
Alert Detail
ParameterSec-Fetch-SiteHeader User-Agent
AttackMozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)
Alert Detail
Instances3
Solution -
Ensure that Sec-Fetch-Site header is included in request headers.
- -
Reference - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Site - -
CWE Id352
WASC Id9
Plugin Id90005
-
- - - - - - - - - - - - - - - + - + - + - + - + - + - + - + - + - + - + - + - + + href="https://www.zaproxy.org/docs/alerts/10104/">10104
-
Informational
Sec-Fetch-User Header is Missing
Description -
Specifies if a navigation request was initiated by a user.
- -
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
Alert Detail
ParameterSec-Fetch-UserHeader User-Agent
AttackMozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4
Alert Detail
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txthttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
Alert Detail
ParameterSec-Fetch-UserHeader User-Agent
AttackMozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
Alert Detail
URLhttps://chefs-dev.apps.silver.devops.gov.bc.ca/sitemap.xmlhttps://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253
Alert Detail
ParameterSec-Fetch-UserHeader User-Agent
Attackmsnbot/1.1 (+http://search.msn.com/msnbot.htm)
Alert Detail
Instances312
Solution -
Ensure that Sec-Fetch-User header is included in user initiated requests.
- -
Reference - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-User + https://owasp.org/wstg
CWE Id352
WASC Id9
Plugin Id 90005
diff --git a/report_json.json b/report_json.json index 04e518b5a..94539151e 100644 --- a/report_json.json +++ b/report_json.json @@ -1,7 +1,7 @@ { "@programName": "ZAP", "@version": "2.14.0", - "@generated": "Wed, 7 Feb 2024 19:48:22", + "@generated": "Thu, 8 Feb 2024 15:59:10", "site":[ { "@name": "https://chefs-dev.apps.silver.devops.gov.bc.ca", @@ -9,6 +9,33 @@ "@port": "443", "@ssl": "true", "alerts": [ + { + "pluginid": "10055", + "alertRef": "10055-4", + "alert": "CSP: Wildcard Directive", + "name": "CSP: Wildcard Directive", + "riskcode": "2", + "confidence": "3", + "riskdesc": "Medium (High)", + "desc": "

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page \u2014 covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files.

", + "instances":[ + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", + "method": "GET", + "param": "content-security-policy", + "attack": "", + "evidence": "default-src 'none'", + "otherinfo": "The following directives either allow wildcard sources (or ancestors), are not defined, or are overly broadly defined: \nframe-ancestors, form-action\n\nThe directive(s): frame-ancestors, form-action are among the directives that do not fallback to default-src, missing/excluding them is the same as allowing anything." + } + ], + "count": "1", + "solution": "

Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.

", + "otherinfo": "

The following directives either allow wildcard sources (or ancestors), are not defined, or are overly broadly defined:

frame-ancestors, form-action

The directive(s): frame-ancestors, form-action are among the directives that do not fallback to default-src, missing/excluding them is the same as allowing anything.

", + "reference": "

https://www.w3.org/TR/CSP/

https://caniuse.com/#search=content+security+policy

https://content-security-policy.com/

https://github.com/HtmlUnit/htmlunit-csp

https://developers.google.com/web/fundamentals/security/csp#policy_applies_to_a_wide_variety_of_resources

", + "cweid": "693", + "wascid": "15", + "sourceid": "1" + }, { "pluginid": "10038", "alertRef": "10038-1", @@ -28,7 +55,7 @@ "otherinfo": "" }, { - "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275", + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/", "method": "GET", "param": "", "attack": "", @@ -60,6 +87,95 @@ "wascid": "15", "sourceid": "8" }, + { + "pluginid": "10020", + "alertRef": "10020-1", + "alert": "Missing Anti-clickjacking Header", + "name": "Missing Anti-clickjacking Header", + "riskcode": "2", + "confidence": "2", + "riskdesc": "Medium (Medium)", + "desc": "

The response does not include either Content-Security-Policy with 'frame-ancestors' directive or X-Frame-Options to protect against 'ClickJacking' attacks.

", + "instances":[ + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/", + "method": "GET", + "param": "x-frame-options", + "attack": "", + "evidence": "", + "otherinfo": "" + } + ], + "count": "1", + "solution": "

Modern Web browsers support the Content-Security-Policy and X-Frame-Options HTTP headers. Ensure one of them is set on all web pages returned by your site/app.

If you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. Alternatively consider implementing Content Security Policy's \"frame-ancestors\" directive.

", + "otherinfo": "", + "reference": "

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

", + "cweid": "1021", + "wascid": "15", + "sourceid": "3" + }, + { + "pluginid": "40025", + "alertRef": "40025", + "alert": "Proxy Disclosure", + "name": "Proxy Disclosure", + "riskcode": "2", + "confidence": "2", + "riskdesc": "Medium (Medium)", + "desc": "

1 proxy server(s) were detected or fingerprinted. This information helps a potential attacker to determine

- A list of targets for an attack against the application.

- Potential vulnerabilities on the proxy servers that service the application.

- The presence or absence of any proxy-based components that might cause attacks against the application to be detected, prevented, or mitigated.

", + "instances":[ + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", + "method": "GET", + "param": "", + "attack": "TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.", + "evidence": "", + "otherinfo": "Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: \n- Unknown\nThe following web/application server has been identified: \n- [Express]\n" + }, + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/", + "method": "GET", + "param": "", + "attack": "TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.", + "evidence": "", + "otherinfo": "Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: \n- Unknown\nThe following web/application server has been identified: \n- [Express]\n" + } + ], + "count": "2", + "solution": "

Disable the 'TRACE' method on the proxy servers, as well as the origin web/application server.

Disable the 'OPTIONS' method on the proxy servers, as well as the origin web/application server, if it is not required for other purposes, such as 'CORS' (Cross Origin Resource Sharing).

Configure the web and application servers with custom error pages, to prevent 'fingerprintable' product-specific error pages being leaked to the user in the event of HTTP errors, such as 'TRACK' requests for non-existent pages.

Configure all proxies, application servers, and web servers to prevent disclosure of the technology and version information in the 'Server' and 'X-Powered-By' HTTP response headers.

", + "otherinfo": "

Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server:

- Unknown

The following web/application server has been identified:

- [Express]

", + "reference": "

https://tools.ietf.org/html/rfc7231#section-5.1.2

", + "cweid": "200", + "wascid": "45", + "sourceid": "453" + }, + { + "pluginid": "10054", + "alertRef": "10054-2", + "alert": "Cookie with SameSite Attribute None", + "name": "Cookie with SameSite Attribute None", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "

A cookie has been set with its SameSite attribute set to \"none\", which means that the cookie can be sent as a result of a 'cross-site' request. The SameSite attribute is an effective counter measure to cross-site request forgery, cross-site script inclusion, and timing attacks.

", + "instances":[ + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", + "method": "GET", + "param": "eed6a67d093ebd7ab21b438a506ffb35", + "attack": "", + "evidence": "set-cookie: eed6a67d093ebd7ab21b438a506ffb35", + "otherinfo": "" + } + ], + "count": "1", + "solution": "

Ensure that the SameSite attribute is set to either 'lax' or ideally 'strict' for all cookies.

", + "otherinfo": "", + "reference": "

https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site

", + "cweid": "1275", + "wascid": "13", + "sourceid": "1" + }, { "pluginid": "10063", "alertRef": "10063-1", @@ -79,7 +195,7 @@ "otherinfo": "" }, { - "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275", + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/", "method": "GET", "param": "", "attack": "", @@ -111,6 +227,41 @@ "wascid": "15", "sourceid": "8" }, + { + "pluginid": "10037", + "alertRef": "10037", + "alert": "Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)", + "name": "Server Leaks Information via \"X-Powered-By\" HTTP Response Header Field(s)", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "

The web/application server is leaking information via one or more \"X-Powered-By\" HTTP response headers. Access to such information may facilitate attackers identifying other frameworks/components your web application is reliant upon and the vulnerabilities such components may be subject to.

", + "instances":[ + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", + "method": "GET", + "param": "", + "attack": "", + "evidence": "x-powered-by: Express", + "otherinfo": "" + }, + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/", + "method": "GET", + "param": "", + "attack": "", + "evidence": "x-powered-by: Express", + "otherinfo": "" + } + ], + "count": "2", + "solution": "

Ensure that your web server, application server, load balancer, etc. is configured to suppress \"X-Powered-By\" headers.

", + "otherinfo": "", + "reference": "

https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/01-Information_Gathering/08-Fingerprint_Web_Application_Framework

https://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html

", + "cweid": "200", + "wascid": "13", + "sourceid": "1" + }, { "pluginid": "10035", "alertRef": "10035-1", @@ -130,7 +281,7 @@ "otherinfo": "" }, { - "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275", + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/", "method": "GET", "param": "", "attack": "", @@ -162,6 +313,95 @@ "wascid": "15", "sourceid": "8" }, + { + "pluginid": "10021", + "alertRef": "10021", + "alert": "X-Content-Type-Options Header Missing", + "name": "X-Content-Type-Options Header Missing", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "

The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing.

", + "instances":[ + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/", + "method": "GET", + "param": "x-content-type-options", + "attack": "", + "evidence": "", + "otherinfo": "This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.\nAt \"High\" threshold this scan rule will not alert on client or server error responses." + } + ], + "count": "1", + "solution": "

Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages.

If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing.

", + "otherinfo": "

This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type.

At \"High\" threshold this scan rule will not alert on client or server error responses.

", + "reference": "

https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/compatibility/gg622941(v=vs.85)

https://owasp.org/www-community/Security_Headers

", + "cweid": "693", + "wascid": "15", + "sourceid": "3" + }, + { + "pluginid": "90027", + "alertRef": "90027", + "alert": "Cookie Slack Detector", + "name": "Cookie Slack Detector", + "riskcode": "0", + "confidence": "1", + "riskdesc": "Informational (Low)", + "desc": "

Repeated GET requests: drop a different cookie each time, followed by normal request with all cookies to stabilize session, compare responses against original baseline GET. This can reveal areas where cookie based authentication/attributes are not actually enforced.

", + "instances":[ + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "Cookies that don't have expected effects can reveal flaws in application logic. In the worst case, this can reveal where authentication via cookie token(s) is not actually enforced.\nThese cookies affected the response: \nThese cookies did NOT affect the response: eed6a67d093ebd7ab21b438a506ffb35\n" + }, + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "Cookies that don't have expected effects can reveal flaws in application logic. In the worst case, this can reveal where authentication via cookie token(s) is not actually enforced.\nThese cookies affected the response: \nThese cookies did NOT affect the response: eed6a67d093ebd7ab21b438a506ffb35\n" + } + ], + "count": "2", + "solution": "", + "otherinfo": "

Cookies that don't have expected effects can reveal flaws in application logic. In the worst case, this can reveal where authentication via cookie token(s) is not actually enforced.

These cookies affected the response:

These cookies did NOT affect the response: eed6a67d093ebd7ab21b438a506ffb35

", + "reference": "

https://cwe.mitre.org/data/definitions/205.html

", + "cweid": "200", + "wascid": "45", + "sourceid": "553" + }, + { + "pluginid": "10109", + "alertRef": "10109", + "alert": "Modern Web Application", + "name": "Modern Web Application", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "

The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.

", + "instances":[ + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + } + ], + "count": "1", + "solution": "

This is an informational alert and so no changes are required.

", + "otherinfo": "

No links have been found while there are scripts, which is an indication that this is a modern web application.

", + "reference": "", + "cweid": "-1", + "wascid": "-1", + "sourceid": "3" + }, { "pluginid": "10049", "alertRef": "10049", @@ -181,11 +421,11 @@ "otherinfo": "" }, { - "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275", + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", "method": "GET", "param": "", "attack": "", - "evidence": "no-store", + "evidence": "private", "otherinfo": "" }, { @@ -213,6 +453,33 @@ "wascid": "13", "sourceid": "8" }, + { + "pluginid": "10015", + "alertRef": "10015", + "alert": "Re-examine Cache-control Directives", + "name": "Re-examine Cache-control Directives", + "riskcode": "0", + "confidence": "1", + "riskdesc": "Informational (Low)", + "desc": "

The cache-control header has not been set properly or is missing, allowing the browser and proxies to cache content. For static assets like css, js, or image files this might be intended, however, the resources should be reviewed to ensure that no sensitive content will be cached.

", + "instances":[ + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/", + "method": "GET", + "param": "cache-control", + "attack": "", + "evidence": "public, max-age=0", + "otherinfo": "" + } + ], + "count": "1", + "solution": "

For secure content, ensure the cache-control HTTP header is set with \"no-cache, no-store, must-revalidate\". If an asset should be cached consider setting the directives \"public, max-age, immutable\".

", + "otherinfo": "", + "reference": "

https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#web-content-caching

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control

https://grayduck.mn/2021/09/13/cache-control-recommendations/

", + "cweid": "525", + "wascid": "13", + "sourceid": "3" + }, { "pluginid": "90005", "alertRef": "90005-3", @@ -224,7 +491,7 @@ "desc": "

Specifies how and where the data would be used. For instance, if the value is audio, then the requested resource must be audio data and not any other type of resource.

", "instances":[ { - "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275", + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/", "method": "GET", "param": "Sec-Fetch-Dest", "attack": "", @@ -232,7 +499,7 @@ "otherinfo": "" }, { - "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt", + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", "method": "GET", "param": "Sec-Fetch-Dest", "attack": "", @@ -240,7 +507,15 @@ "otherinfo": "" }, { - "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/sitemap.xml", + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/", + "method": "GET", + "param": "Sec-Fetch-Dest", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt", "method": "GET", "param": "Sec-Fetch-Dest", "attack": "", @@ -248,13 +523,13 @@ "otherinfo": "" } ], - "count": "3", + "count": "4", "solution": "

Ensure that Sec-Fetch-Dest header is included in request headers.

", "otherinfo": "", "reference": "

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Dest

", "cweid": "352", "wascid": "9", - "sourceid": "1" + "sourceid": "8" }, { "pluginid": "90005", @@ -267,7 +542,7 @@ "desc": "

Allows to differentiate between requests for navigating between HTML pages and requests for loading resources like images, audio etc.

", "instances":[ { - "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275", + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/", "method": "GET", "param": "Sec-Fetch-Mode", "attack": "", @@ -275,7 +550,7 @@ "otherinfo": "" }, { - "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt", + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", "method": "GET", "param": "Sec-Fetch-Mode", "attack": "", @@ -283,7 +558,15 @@ "otherinfo": "" }, { - "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/sitemap.xml", + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/", + "method": "GET", + "param": "Sec-Fetch-Mode", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt", "method": "GET", "param": "Sec-Fetch-Mode", "attack": "", @@ -291,13 +574,13 @@ "otherinfo": "" } ], - "count": "3", + "count": "4", "solution": "

Ensure that Sec-Fetch-Mode header is included in request headers.

", "otherinfo": "", "reference": "

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Mode

", "cweid": "352", "wascid": "9", - "sourceid": "1" + "sourceid": "8" }, { "pluginid": "90005", @@ -310,7 +593,7 @@ "desc": "

Specifies the relationship between request initiator's origin and target's origin.

", "instances":[ { - "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275", + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/", "method": "GET", "param": "Sec-Fetch-Site", "attack": "", @@ -318,7 +601,7 @@ "otherinfo": "" }, { - "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt", + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", "method": "GET", "param": "Sec-Fetch-Site", "attack": "", @@ -326,7 +609,15 @@ "otherinfo": "" }, { - "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/sitemap.xml", + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/", + "method": "GET", + "param": "Sec-Fetch-Site", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt", "method": "GET", "param": "Sec-Fetch-Site", "attack": "", @@ -334,13 +625,13 @@ "otherinfo": "" } ], - "count": "3", + "count": "4", "solution": "

Ensure that Sec-Fetch-Site header is included in request headers.

", "otherinfo": "", "reference": "

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Site

", "cweid": "352", "wascid": "9", - "sourceid": "1" + "sourceid": "8" }, { "pluginid": "90005", @@ -353,7 +644,7 @@ "desc": "

Specifies if a navigation request was initiated by a user.

", "instances":[ { - "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275", + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/", "method": "GET", "param": "Sec-Fetch-User", "attack": "", @@ -361,7 +652,7 @@ "otherinfo": "" }, { - "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt", + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", "method": "GET", "param": "Sec-Fetch-User", "attack": "", @@ -369,7 +660,15 @@ "otherinfo": "" }, { - "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/sitemap.xml", + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/", + "method": "GET", + "param": "Sec-Fetch-User", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt", "method": "GET", "param": "Sec-Fetch-User", "attack": "", @@ -377,13 +676,182 @@ "otherinfo": "" } ], - "count": "3", + "count": "4", "solution": "

Ensure that Sec-Fetch-User header is included in user initiated requests.

", "otherinfo": "", "reference": "

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-User

", "cweid": "352", "wascid": "9", + "sourceid": "8" + }, + { + "pluginid": "10112", + "alertRef": "10112", + "alert": "Session Management Response Identified", + "name": "Session Management Response Identified", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "

The given response has been identified as containing a session management token. The 'Other Info' field contains a set of header tokens that can be used in the Header Based Session Management Method. If the request is in a context which has a Session Management Method set to \"Auto-Detect\" then this rule will change the session management to use the tokens identified.

", + "instances":[ + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", + "method": "GET", + "param": "eed6a67d093ebd7ab21b438a506ffb35", + "attack": "", + "evidence": "0638612519a4a4e878d1de05d5624c14", + "otherinfo": "\ncookie:eed6a67d093ebd7ab21b438a506ffb35" + } + ], + "count": "1", + "solution": "

This is an informational alert rather than a vulnerability and so there is nothing to fix.

", + "otherinfo": "

cookie:eed6a67d093ebd7ab21b438a506ffb35

", + "reference": "

https://www.zaproxy.org/docs/desktop/addons/authentication-helper/session-mgmt-id

", + "cweid": "-1", + "wascid": "-1", "sourceid": "1" + }, + { + "pluginid": "10049", + "alertRef": "10049", + "alert": "Storable but Non-Cacheable Content", + "name": "Storable but Non-Cacheable Content", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "

The response contents are storable by caching components such as proxy servers, but will not be retrieved directly from the cache, without validating the request upstream, in response to similar requests from other users.

", + "instances":[ + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + } + ], + "count": "1", + "solution": "", + "otherinfo": "", + "reference": "

https://datatracker.ietf.org/doc/html/rfc7234

https://datatracker.ietf.org/doc/html/rfc7231

https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html

", + "cweid": "524", + "wascid": "13", + "sourceid": "3" + }, + { + "pluginid": "10104", + "alertRef": "10104", + "alert": "User Agent Fuzzer", + "name": "User Agent Fuzzer", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "

Check for differences in response based on fuzzed User Agent (eg. mobile sites, access as a Search Engine Crawler). Compares the response statuscode and the hashcode of the response body with the original response.

", + "instances":[ + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)", + "evidence": "", + "otherinfo": "" + }, + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)", + "evidence": "", + "otherinfo": "" + }, + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)", + "evidence": "", + "otherinfo": "" + }, + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko", + "evidence": "", + "otherinfo": "" + }, + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0", + "evidence": "", + "otherinfo": "" + }, + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", + "evidence": "", + "otherinfo": "" + }, + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/91.0", + "evidence": "", + "otherinfo": "" + }, + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)", + "evidence": "", + "otherinfo": "" + }, + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)", + "evidence": "", + "otherinfo": "" + }, + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4", + "evidence": "", + "otherinfo": "" + }, + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16", + "evidence": "", + "otherinfo": "" + }, + { + "uri": "https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253", + "method": "GET", + "param": "Header User-Agent", + "attack": "msnbot/1.1 (+http://search.msn.com/msnbot.htm)", + "evidence": "", + "otherinfo": "" + } + ], + "count": "12", + "solution": "", + "otherinfo": "", + "reference": "

https://owasp.org/wstg

", + "cweid": "0", + "wascid": "0", + "sourceid": "215" } ] } diff --git a/report_md.md b/report_md.md index 9378e01e4..1d31c09db 100644 --- a/report_md.md +++ b/report_md.md @@ -6,9 +6,9 @@ | Risk Level | Number of Alerts | | --- | --- | | High | 0 | -| Medium | 1 | -| Low | 2 | -| Informational | 5 | +| Medium | 4 | +| Low | 5 | +| Informational | 11 | @@ -17,14 +17,26 @@ | Name | Risk Level | Number of Instances | | --- | --- | --- | +| CSP: Wildcard Directive | Medium | 1 | | Content Security Policy (CSP) Header Not Set | Medium | 4 | +| Missing Anti-clickjacking Header | Medium | 1 | +| Proxy Disclosure | Medium | 2 | +| Cookie with SameSite Attribute None | Low | 1 | | Permissions Policy Header Not Set | Low | 4 | +| Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) | Low | 2 | | Strict-Transport-Security Header Not Set | Low | 4 | +| X-Content-Type-Options Header Missing | Low | 1 | +| Cookie Slack Detector | Informational | 2 | +| Modern Web Application | Informational | 1 | | Non-Storable Content | Informational | 4 | -| Sec-Fetch-Dest Header is Missing | Informational | 3 | -| Sec-Fetch-Mode Header is Missing | Informational | 3 | -| Sec-Fetch-Site Header is Missing | Informational | 3 | -| Sec-Fetch-User Header is Missing | Informational | 3 | +| Re-examine Cache-control Directives | Informational | 1 | +| Sec-Fetch-Dest Header is Missing | Informational | 4 | +| Sec-Fetch-Mode Header is Missing | Informational | 4 | +| Sec-Fetch-Site Header is Missing | Informational | 4 | +| Sec-Fetch-User Header is Missing | Informational | 4 | +| Session Management Response Identified | Informational | 1 | +| Storable but Non-Cacheable Content | Informational | 1 | +| User Agent Fuzzer | Informational | 12 | @@ -33,6 +45,49 @@ +### [ CSP: Wildcard Directive ](https://www.zaproxy.org/docs/alerts/10055/) + + + +##### Medium (High) + +### Description + +Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files. + +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 + * Method: `GET` + * Parameter: `content-security-policy` + * Attack: `` + * Evidence: `default-src 'none'` + * Other Info: `The following directives either allow wildcard sources (or ancestors), are not defined, or are overly broadly defined: +frame-ancestors, form-action + +The directive(s): frame-ancestors, form-action are among the directives that do not fallback to default-src, missing/excluding them is the same as allowing anything.` + +Instances: 1 + +### Solution + +Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header. + +### Reference + + +* [ https://www.w3.org/TR/CSP/ ](https://www.w3.org/TR/CSP/) +* [ https://caniuse.com/#search=content+security+policy ](https://caniuse.com/#search=content+security+policy) +* [ https://content-security-policy.com/ ](https://content-security-policy.com/) +* [ https://github.com/HtmlUnit/htmlunit-csp ](https://github.com/HtmlUnit/htmlunit-csp) +* [ https://developers.google.com/web/fundamentals/security/csp#policy_applies_to_a_wide_variety_of_resources ](https://developers.google.com/web/fundamentals/security/csp#policy_applies_to_a_wide_variety_of_resources) + + +#### CWE Id: [ 693 ](https://cwe.mitre.org/data/definitions/693.html) + + +#### WASC Id: 15 + +#### Source ID: 3 + ### [ Content Security Policy (CSP) Header Not Set ](https://www.zaproxy.org/docs/alerts/10038/) @@ -49,7 +104,7 @@ Content Security Policy (CSP) is an added layer of security that helps to detect * Attack: `` * Evidence: `` * Other Info: `` -* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275 +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/ * Method: `GET` * Parameter: `` * Attack: `` @@ -93,6 +148,136 @@ Ensure that your web server, application server, load balancer, etc. is configur #### Source ID: 3 +### [ Missing Anti-clickjacking Header ](https://www.zaproxy.org/docs/alerts/10020/) + + + +##### Medium (Medium) + +### Description + +The response does not include either Content-Security-Policy with 'frame-ancestors' directive or X-Frame-Options to protect against 'ClickJacking' attacks. + +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/ + * Method: `GET` + * Parameter: `x-frame-options` + * Attack: `` + * Evidence: `` + * Other Info: `` + +Instances: 1 + +### Solution + +Modern Web browsers support the Content-Security-Policy and X-Frame-Options HTTP headers. Ensure one of them is set on all web pages returned by your site/app. +If you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. Alternatively consider implementing Content Security Policy's "frame-ancestors" directive. + +### Reference + + +* [ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options ](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options) + + +#### CWE Id: [ 1021 ](https://cwe.mitre.org/data/definitions/1021.html) + + +#### WASC Id: 15 + +#### Source ID: 3 + +### [ Proxy Disclosure ](https://www.zaproxy.org/docs/alerts/40025/) + + + +##### Medium (Medium) + +### Description + +1 proxy server(s) were detected or fingerprinted. This information helps a potential attacker to determine + - A list of targets for an attack against the application. + - Potential vulnerabilities on the proxy servers that service the application. + - The presence or absence of any proxy-based components that might cause attacks against the application to be detected, prevented, or mitigated. + +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +The following web/application server has been identified: +- [Express] +` +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/ + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +The following web/application server has been identified: +- [Express] +` + +Instances: 2 + +### Solution + +Disable the 'TRACE' method on the proxy servers, as well as the origin web/application server. +Disable the 'OPTIONS' method on the proxy servers, as well as the origin web/application server, if it is not required for other purposes, such as 'CORS' (Cross Origin Resource Sharing). +Configure the web and application servers with custom error pages, to prevent 'fingerprintable' product-specific error pages being leaked to the user in the event of HTTP errors, such as 'TRACK' requests for non-existent pages. +Configure all proxies, application servers, and web servers to prevent disclosure of the technology and version information in the 'Server' and 'X-Powered-By' HTTP response headers. + + +### Reference + + +* [ https://tools.ietf.org/html/rfc7231#section-5.1.2 ](https://tools.ietf.org/html/rfc7231#section-5.1.2) + + +#### CWE Id: [ 200 ](https://cwe.mitre.org/data/definitions/200.html) + + +#### WASC Id: 45 + +#### Source ID: 1 + +### [ Cookie with SameSite Attribute None ](https://www.zaproxy.org/docs/alerts/10054/) + + + +##### Low (Medium) + +### Description + +A cookie has been set with its SameSite attribute set to "none", which means that the cookie can be sent as a result of a 'cross-site' request. The SameSite attribute is an effective counter measure to cross-site request forgery, cross-site script inclusion, and timing attacks. + +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 + * Method: `GET` + * Parameter: `eed6a67d093ebd7ab21b438a506ffb35` + * Attack: `` + * Evidence: `set-cookie: eed6a67d093ebd7ab21b438a506ffb35` + * Other Info: `` + +Instances: 1 + +### Solution + +Ensure that the SameSite attribute is set to either 'lax' or ideally 'strict' for all cookies. + +### Reference + + +* [ https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site ](https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site) + + +#### CWE Id: [ 1275 ](https://cwe.mitre.org/data/definitions/1275.html) + + +#### WASC Id: 13 + +#### Source ID: 3 + ### [ Permissions Policy Header Not Set ](https://www.zaproxy.org/docs/alerts/10063/) @@ -109,7 +294,7 @@ Permissions Policy Header is an added layer of security that helps to restrict f * Attack: `` * Evidence: `` * Other Info: `` -* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275 +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/ * Method: `GET` * Parameter: `` * Attack: `` @@ -151,6 +336,49 @@ Ensure that your web server, application server, load balancer, etc. is configur #### Source ID: 3 +### [ Server Leaks Information via "X-Powered-By" HTTP Response Header Field(s) ](https://www.zaproxy.org/docs/alerts/10037/) + + + +##### Low (Medium) + +### Description + +The web/application server is leaking information via one or more "X-Powered-By" HTTP response headers. Access to such information may facilitate attackers identifying other frameworks/components your web application is reliant upon and the vulnerabilities such components may be subject to. + +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `x-powered-by: Express` + * Other Info: `` +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/ + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `x-powered-by: Express` + * Other Info: `` + +Instances: 2 + +### Solution + +Ensure that your web server, application server, load balancer, etc. is configured to suppress "X-Powered-By" headers. + +### Reference + + +* [ https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/01-Information_Gathering/08-Fingerprint_Web_Application_Framework ](https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/01-Information_Gathering/08-Fingerprint_Web_Application_Framework) +* [ https://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html ](https://www.troyhunt.com/2012/02/shhh-dont-let-your-response-headers.html) + + +#### CWE Id: [ 200 ](https://cwe.mitre.org/data/definitions/200.html) + + +#### WASC Id: 13 + +#### Source ID: 3 + ### [ Strict-Transport-Security Header Not Set ](https://www.zaproxy.org/docs/alerts/10035/) @@ -167,7 +395,7 @@ HTTP Strict Transport Security (HSTS) is a web security policy mechanism whereby * Attack: `` * Evidence: `` * Other Info: `` -* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275 +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/ * Method: `GET` * Parameter: `` * Attack: `` @@ -207,6 +435,123 @@ Ensure that your web server, application server, load balancer, etc. is configur #### WASC Id: 15 +#### Source ID: 3 + +### [ X-Content-Type-Options Header Missing ](https://www.zaproxy.org/docs/alerts/10021/) + + + +##### Low (Medium) + +### Description + +The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing. + +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/ + * Method: `GET` + * Parameter: `x-content-type-options` + * Attack: `` + * Evidence: `` + * Other Info: `This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type. +At "High" threshold this scan rule will not alert on client or server error responses.` + +Instances: 1 + +### Solution + +Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages. +If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing. + +### Reference + + +* [ https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/compatibility/gg622941(v=vs.85) ](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/compatibility/gg622941(v=vs.85)) +* [ https://owasp.org/www-community/Security_Headers ](https://owasp.org/www-community/Security_Headers) + + +#### CWE Id: [ 693 ](https://cwe.mitre.org/data/definitions/693.html) + + +#### WASC Id: 15 + +#### Source ID: 3 + +### [ Cookie Slack Detector ](https://www.zaproxy.org/docs/alerts/90027/) + + + +##### Informational (Low) + +### Description + +Repeated GET requests: drop a different cookie each time, followed by normal request with all cookies to stabilize session, compare responses against original baseline GET. This can reveal areas where cookie based authentication/attributes are not actually enforced. + +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `` + * Other Info: `Cookies that don't have expected effects can reveal flaws in application logic. In the worst case, this can reveal where authentication via cookie token(s) is not actually enforced. +These cookies affected the response: +These cookies did NOT affect the response: eed6a67d093ebd7ab21b438a506ffb35 +` +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/ + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `` + * Other Info: `Cookies that don't have expected effects can reveal flaws in application logic. In the worst case, this can reveal where authentication via cookie token(s) is not actually enforced. +These cookies affected the response: +These cookies did NOT affect the response: eed6a67d093ebd7ab21b438a506ffb35 +` + +Instances: 2 + +### Solution + + + +### Reference + + +* [ https://cwe.mitre.org/data/definitions/205.html ](https://cwe.mitre.org/data/definitions/205.html) + + +#### CWE Id: [ 200 ](https://cwe.mitre.org/data/definitions/200.html) + + +#### WASC Id: 45 + +#### Source ID: 1 + +### [ Modern Web Application ](https://www.zaproxy.org/docs/alerts/10109/) + + + +##### Informational (Medium) + +### Description + +The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one. + +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/ + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `` + * Other Info: `No links have been found while there are scripts, which is an indication that this is a modern web application.` + +Instances: 1 + +### Solution + +This is an informational alert and so no changes are required. + +### Reference + + + + #### Source ID: 3 ### [ Non-Storable Content ](https://www.zaproxy.org/docs/alerts/10049/) @@ -225,11 +570,11 @@ The response contents are not storable by caching components such as proxy serve * Attack: `` * Evidence: `no-store` * Other Info: `` -* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275 +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 * Method: `GET` * Parameter: `` * Attack: `` - * Evidence: `no-store` + * Evidence: `private` * Other Info: `` * URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt * Method: `GET` @@ -272,6 +617,44 @@ It must have a status code that is defined as cacheable by default (200, 203, 20 #### CWE Id: [ 524 ](https://cwe.mitre.org/data/definitions/524.html) +#### WASC Id: 13 + +#### Source ID: 3 + +### [ Re-examine Cache-control Directives ](https://www.zaproxy.org/docs/alerts/10015/) + + + +##### Informational (Low) + +### Description + +The cache-control header has not been set properly or is missing, allowing the browser and proxies to cache content. For static assets like css, js, or image files this might be intended, however, the resources should be reviewed to ensure that no sensitive content will be cached. + +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/ + * Method: `GET` + * Parameter: `cache-control` + * Attack: `` + * Evidence: `public, max-age=0` + * Other Info: `` + +Instances: 1 + +### Solution + +For secure content, ensure the cache-control HTTP header is set with "no-cache, no-store, must-revalidate". If an asset should be cached consider setting the directives "public, max-age, immutable". + +### Reference + + +* [ https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#web-content-caching ](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#web-content-caching) +* [ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control ](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control) +* [ https://grayduck.mn/2021/09/13/cache-control-recommendations/ ](https://grayduck.mn/2021/09/13/cache-control-recommendations/) + + +#### CWE Id: [ 525 ](https://cwe.mitre.org/data/definitions/525.html) + + #### WASC Id: 13 #### Source ID: 3 @@ -286,26 +669,32 @@ It must have a status code that is defined as cacheable by default (200, 203, 20 Specifies how and where the data would be used. For instance, if the value is audio, then the requested resource must be audio data and not any other type of resource. -* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275 +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/ * Method: `GET` * Parameter: `Sec-Fetch-Dest` * Attack: `` * Evidence: `` * Other Info: `` -* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 * Method: `GET` * Parameter: `Sec-Fetch-Dest` * Attack: `` * Evidence: `` * Other Info: `` -* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/sitemap.xml +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/ + * Method: `GET` + * Parameter: `Sec-Fetch-Dest` + * Attack: `` + * Evidence: `` + * Other Info: `` +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt * Method: `GET` * Parameter: `Sec-Fetch-Dest` * Attack: `` * Evidence: `` * Other Info: `` -Instances: 3 +Instances: 4 ### Solution @@ -334,26 +723,32 @@ Ensure that Sec-Fetch-Dest header is included in request headers. Allows to differentiate between requests for navigating between HTML pages and requests for loading resources like images, audio etc. -* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275 +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/ * Method: `GET` * Parameter: `Sec-Fetch-Mode` * Attack: `` * Evidence: `` * Other Info: `` -* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 * Method: `GET` * Parameter: `Sec-Fetch-Mode` * Attack: `` * Evidence: `` * Other Info: `` -* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/sitemap.xml +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/ + * Method: `GET` + * Parameter: `Sec-Fetch-Mode` + * Attack: `` + * Evidence: `` + * Other Info: `` +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt * Method: `GET` * Parameter: `Sec-Fetch-Mode` * Attack: `` * Evidence: `` * Other Info: `` -Instances: 3 +Instances: 4 ### Solution @@ -382,26 +777,32 @@ Ensure that Sec-Fetch-Mode header is included in request headers. Specifies the relationship between request initiator's origin and target's origin. -* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275 +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/ * Method: `GET` * Parameter: `Sec-Fetch-Site` * Attack: `` * Evidence: `` * Other Info: `` -* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 * Method: `GET` * Parameter: `Sec-Fetch-Site` * Attack: `` * Evidence: `` * Other Info: `` -* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/sitemap.xml +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/ + * Method: `GET` + * Parameter: `Sec-Fetch-Site` + * Attack: `` + * Evidence: `` + * Other Info: `` +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt * Method: `GET` * Parameter: `Sec-Fetch-Site` * Attack: `` * Evidence: `` * Other Info: `` -Instances: 3 +Instances: 4 ### Solution @@ -430,26 +831,32 @@ Ensure that Sec-Fetch-Site header is included in request headers. Specifies if a navigation request was initiated by a user. -* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1275 +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/ * Method: `GET` * Parameter: `Sec-Fetch-User` * Attack: `` * Evidence: `` * Other Info: `` -* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 * Method: `GET` * Parameter: `Sec-Fetch-User` * Attack: `` * Evidence: `` * Other Info: `` -* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/sitemap.xml +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/ + * Method: `GET` + * Parameter: `Sec-Fetch-User` + * Attack: `` + * Evidence: `` + * Other Info: `` +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/robots.txt * Method: `GET` * Parameter: `Sec-Fetch-User` * Attack: `` * Evidence: `` * Other Info: `` -Instances: 3 +Instances: 4 ### Solution @@ -468,4 +875,173 @@ Ensure that Sec-Fetch-User header is included in user initiated requests. #### Source ID: 3 +### [ Session Management Response Identified ](https://www.zaproxy.org/docs/alerts/10112/) + + + +##### Informational (Medium) + +### Description + +The given response has been identified as containing a session management token. The 'Other Info' field contains a set of header tokens that can be used in the Header Based Session Management Method. If the request is in a context which has a Session Management Method set to "Auto-Detect" then this rule will change the session management to use the tokens identified. + +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 + * Method: `GET` + * Parameter: `eed6a67d093ebd7ab21b438a506ffb35` + * Attack: `` + * Evidence: `0638612519a4a4e878d1de05d5624c14` + * Other Info: ` +cookie:eed6a67d093ebd7ab21b438a506ffb35` + +Instances: 1 + +### Solution + +This is an informational alert rather than a vulnerability and so there is nothing to fix. + +### Reference + + +* [ https://www.zaproxy.org/docs/desktop/addons/authentication-helper/session-mgmt-id ](https://www.zaproxy.org/docs/desktop/addons/authentication-helper/session-mgmt-id) + + + +#### Source ID: 3 + +### [ Storable but Non-Cacheable Content ](https://www.zaproxy.org/docs/alerts/10049/) + + + +##### Informational (Medium) + +### Description + +The response contents are storable by caching components such as proxy servers, but will not be retrieved directly from the cache, without validating the request upstream, in response to similar requests from other users. + +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253/ + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `max-age=0` + * Other Info: `` + +Instances: 1 + +### Solution + + + +### Reference + + +* [ https://datatracker.ietf.org/doc/html/rfc7234 ](https://datatracker.ietf.org/doc/html/rfc7234) +* [ https://datatracker.ietf.org/doc/html/rfc7231 ](https://datatracker.ietf.org/doc/html/rfc7231) +* [ https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html ](https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html) + + +#### CWE Id: [ 524 ](https://cwe.mitre.org/data/definitions/524.html) + + +#### WASC Id: 13 + +#### Source ID: 3 + +### [ User Agent Fuzzer ](https://www.zaproxy.org/docs/alerts/10104/) + + + +##### Informational (Medium) + +### Description + +Check for differences in response based on fuzzed User Agent (eg. mobile sites, access as a Search Engine Crawler). Compares the response statuscode and the hashcode of the response body with the original response. + +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 + * Method: `GET` + * Parameter: `Header User-Agent` + * Attack: `Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)` + * Evidence: `` + * Other Info: `` +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 + * Method: `GET` + * Parameter: `Header User-Agent` + * Attack: `Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)` + * Evidence: `` + * Other Info: `` +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 + * Method: `GET` + * Parameter: `Header User-Agent` + * Attack: `Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)` + * Evidence: `` + * Other Info: `` +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 + * Method: `GET` + * Parameter: `Header User-Agent` + * Attack: `Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko` + * Evidence: `` + * Other Info: `` +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 + * Method: `GET` + * Parameter: `Header User-Agent` + * Attack: `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0` + * Evidence: `` + * Other Info: `` +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 + * Method: `GET` + * Parameter: `Header User-Agent` + * Attack: `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36` + * Evidence: `` + * Other Info: `` +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 + * Method: `GET` + * Parameter: `Header User-Agent` + * Attack: `Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/91.0` + * Evidence: `` + * Other Info: `` +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 + * Method: `GET` + * Parameter: `Header User-Agent` + * Attack: `Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)` + * Evidence: `` + * Other Info: `` +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 + * Method: `GET` + * Parameter: `Header User-Agent` + * Attack: `Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)` + * Evidence: `` + * Other Info: `` +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 + * Method: `GET` + * Parameter: `Header User-Agent` + * Attack: `Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4` + * Evidence: `` + * Other Info: `` +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 + * Method: `GET` + * Parameter: `Header User-Agent` + * Attack: `Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16` + * Evidence: `` + * Other Info: `` +* URL: https://chefs-dev.apps.silver.devops.gov.bc.ca/pr-1253 + * Method: `GET` + * Parameter: `Header User-Agent` + * Attack: `msnbot/1.1 (+http://search.msn.com/msnbot.htm)` + * Evidence: `` + * Other Info: `` + +Instances: 12 + +### Solution + + + +### Reference + + +* [ https://owasp.org/wstg ](https://owasp.org/wstg) + + + +#### Source ID: 1 +