Wiki source code of owasp-guidelines
Last modified by Kyle Hill on 2025/08/25 11:16
Show last authors
| author | version | line-number | content |
|---|---|---|---|
| 1 | === Vulnerability Fortification === | ||
| 2 | |||
| 3 | |||
| 4 | ==== Anti-CSRF Tokens ==== | ||
| 5 | |||
| 6 | |(% style="width:122px" %)**Severity**|(% style="width:1045px" %)Medium | ||
| 7 | |(% style="width:122px" %)**Description**|(% style="width:1045px" %)A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge or intent in order to perform an action as the victim | ||
| 8 | |(% style="width:122px" %)**Mitigation**|(% style="width:1045px" %)((( | ||
| 9 | Generate a unique nonce or token when rendering the form and store it securely on the server. When the form is submitted, validate that the token included in the request matches the one previously generated and stored | ||
| 10 | ))) | ||
| 11 | |(% style="width:122px" %)((( | ||
| 12 | **Implemented?** | ||
| 13 | )))|(% style="width:1045px" %)✅ | ||
| 14 | |(% style="width:122px" %)**Comments**|(% style="width:1045px" %)Previous findings have suggested that the CSRF token was not present on the login form. This has since been remedied. [[Pull Request>>https://dev.azure.com/ebsphere/ebsphere/_git/migration/pullrequest/650]] | ||
| 15 | |||
| 16 | ==== ==== | ||
| 17 | |||
| 18 | ==== Vulnerable Libraries ==== | ||
| 19 | |||
| 20 | |(% style="width:122px" %)**Severity**|(% style="width:1045px" %)Medium | ||
| 21 | |(% style="width:122px" %)**Description**|(% style="width:1045px" %)The identified libraries appears to be vulnerable | ||
| 22 | |(% style="width:122px" %)**Mitigation**|(% style="width:1045px" %)Upgrade to the latest version of the affected library | ||
| 23 | |(% style="width:122px" %)((( | ||
| 24 | **Implemented?** | ||
| 25 | )))|(% style="width:1045px" %)✅ | ||
| 26 | |(% style="width:122px" %)**Comments**|(% style="width:1045px" %)The library which was flagged was jQuery 3.0.0. This has since been remedied | ||
| 27 | |||
| 28 | ==== ==== | ||
| 29 | |||
| 30 | ==== Anti-clickjacking Header ==== | ||
| 31 | |||
| 32 | |(% style="width:122px" %)**Severity**|(% style="width:1045px" %)Medium | ||
| 33 | |(% style="width:122px" %)**Description**|(% style="width:1045px" %)Clickjacking is the act of embedding legitimate content inside a hidden or transparent frame in order to trick a user into clicking on something different from what they perceive | ||
| 34 | |(% style="width:122px" %)**Mitigation**|(% style="width:1045px" %)Set Content-Security-Policy with 'frame-ancestors' directive or X-Frame-Options | ||
| 35 | |(% style="width:122px" %)((( | ||
| 36 | **Implemented?** | ||
| 37 | )))|(% style="width:1045px" %)✅ | ||
| 38 | |(% style="width:122px" %)**Comments**|(% style="width:1045px" %)Required headers have been set in the **web.config** file of the project | ||
| 39 | |||
| 40 | |||
| 41 | ==== Content-Security-Policy (CSP) Header ==== | ||
| 42 | |||
| 43 | |(% style="width:122px" %)**Severity**|(% style="width:1045px" %)Medium | ||
| 44 | |(% style="width:122px" %)**Description**|(% style="width:1045px" %)Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks but specifying a list of sources from which to load application files | ||
| 45 | |(% style="width:122px" %)**Mitigation**|(% style="width:1045px" %)Declare approved sources of content that browsers should be allowed to load on that page using the Content-Security-Policy header | ||
| 46 | |(% style="width:122px" %)((( | ||
| 47 | **Implemented?** | ||
| 48 | )))|(% style="width:1045px" %)✅ | ||
| 49 | |(% style="width:122px" %)**Comments**|(% style="width:1045px" %)Required header has been set in the **web.config** file of the project | ||
| 50 | |||
| 51 | ==== ==== | ||
| 52 | |||
| 53 | ==== Cross-Domain Java Script Source File Inclusion ==== | ||
| 54 | |||
| 55 | |(% style="width:122px" %)**Severity**|(% style="width:1045px" %)Low | ||
| 56 | |(% style="width:122px" %)**Description**|(% style="width:1045px" %)The page includes one or more script files from a third-party domain | ||
| 57 | |(% style="width:122px" %)**Mitigation**|(% style="width:1045px" %)Ensure JavaScript source files are loaded from only trusted sources, and the sources can't be controlled by end users of the application | ||
| 58 | |(% style="width:122px" %)((( | ||
| 59 | **Implemented?** | ||
| 60 | )))|(% style="width:1045px" %)✅ | ||
| 61 | |(% style="width:122px" %)**Comments**|(% style="width:1045px" %)Strict-Content-Policy has been updated in the **web.config **of the project,** **to include third-party scripts such as Google reCAPTCHA which was previously flag in security audits. | ||
| 62 | |||
| 63 | |||
| 64 | ==== X-Content-Type-Options Header ==== | ||
| 65 | |||
| 66 | |(% style="width:122px" %)**Severity**|(% style="width:1045px" %)Low | ||
| 67 | |(% style="width:122px" %)**Description**|(% style="width:1045px" %)This header is a **security control** that tells browsers **not to **determine the MIME type from a response and instead to strictly follow the declared **Content-Type** | ||
| 68 | |(% style="width:122px" %)**Mitigation**|(% style="width:1045px" %)Include the header **X-Content-Type-Options **and set the value to **NOSNIFF** | ||
| 69 | |(% style="width:122px" %)((( | ||
| 70 | **Implemented?** | ||
| 71 | )))|(% style="width:1045px" %)✅ | ||
| 72 | |(% style="width:122px" %)**Comments**|(% style="width:1045px" %)Required header has been set in the **web.config** file of the project | ||
| 73 | |||
| 74 | |||
| 75 | ==== Cookie Without Secure Flag ==== | ||
| 76 | |||
| 77 | |(% style="width:122px" %)**Severity**|(% style="width:1045px" %)Low | ||
| 78 | |(% style="width:122px" %)**Description**|(% style="width:1045px" %)A cookie has been set without the secure flag, which means that the cookie can be accessed via unencrypted connections | ||
| 79 | |(% style="width:122px" %)**Mitigation**|(% style="width:1045px" %)Whenever a cookie contains sensitive information or is a session token, then it should always be passed using an encrypted channel. Ensure that the secure flag is set for cookies containing such sensitive information | ||
| 80 | |(% style="width:122px" %)((( | ||
| 81 | **Implemented?** | ||
| 82 | )))|(% style="width:1045px" %)✅ | ||
| 83 | |(% style="width:122px" %)**Comments**|(% style="width:1045px" %)Configuration updated to ensure all cookies created by the site are set to secure | ||
| 84 | |||
| 85 | |||
| 86 | ==== Environment Information Leak ==== | ||
| 87 | |||
| 88 | |(% style="width:122px" %)**Severity**|(% style="width:1045px" %)Low | ||
| 89 | |(% style="width:122px" %)**Description**|(% style="width:1045px" %)The web/application server is leaking information via one or more HTTP response headers | ||
| 90 | |(% style="width:122px" %)**Mitigation**|(% style="width:1045px" %)Ensure that your web server, application server, load balancer, etc. is configured to suppress headers | ||
| 91 | |(% style="width:122px" %)((( | ||
| 92 | **Implemented?** | ||
| 93 | )))|(% style="width:1045px" %)✅ | ||
| 94 | |(% style="width:122px" %)**Comments**|(% style="width:1045px" %)Required header(s) have been set to be removed in the **web.config** file of the project (X-Powered-By, Server) | ||
| 95 | |||
| 96 | |||
| 97 | ==== Unsupported Application Versions ==== | ||
| 98 | |||
| 99 | |(% style="width:122px" %)**Severity**|(% style="width:1045px" %)Low | ||
| 100 | |(% style="width:122px" %)**Description**|(% style="width:1045px" %)This website uses ASP.NET version 1.0 or 1.1 | ||
| 101 | |(% style="width:122px" %)**Mitigation**|(% style="width:1045px" %)Ensure the engaged framework is still supported by Microsoft or do an upgrade | ||
| 102 | |(% style="width:122px" %)((( | ||
| 103 | **Implemented?** | ||
| 104 | )))|(% style="width:1045px" %)✅ | ||
| 105 | |(% style="width:122px" %)**Comments**|(% style="width:1045px" %)Target Framework is currently set to 4.7.2. Version 4.7.2 and later ensures that newly created cookies have '**Lax**' as the default value for the '**SameSite**' property | ||
| 106 | |||
| 107 | |||
| 108 | ==== Big Redirect Detected ==== | ||
| 109 | |||
| 110 | |(% style="width:122px" %)**Severity**|(% style="width:1045px" %)Low | ||
| 111 | |(% style="width:122px" %)**Description**|(% style="width:1045px" %)The server has responded with a redirect that seems to provide a large response. This may indicate that although the server sent a redirect it also responded with body content | ||
| 112 | |(% style="width:122px" %)**Mitigation**|(% style="width:1045px" %)Ensure that no sensitive information is leaked via redirect responses. Redirect responses should have almost no content | ||
| 113 | |(% style="width:122px" %)((( | ||
| 114 | **Implemented?** | ||
| 115 | )))|(% style="width:1045px" %)✅ | ||
| 116 | |(% style="width:122px" %)**Comments**|(% style="width:1045px" %) | ||
| 117 | |||
| 118 | |||
| 119 | ==== Strict-Transport-Security Header ==== | ||
| 120 | |||
| 121 | |(% style="width:122px" %)**Severity**|(% style="width:1045px" %)Low | ||
| 122 | |(% style="width:122px" %)**Description**|(% style="width:1045px" %)HTTP Strict Transport Security (HSTS) is a web security policy mechanism whereby a web server declares that complying user agents (such as a web browser) are to interact with it using only secure HTTPS connections | ||
| 123 | |(% style="width:122px" %)**Mitigation**|(% style="width:1045px" %)Ensure that your web server, application server, load balancer, etc. is configured to enforce Strict-Transport-Security | ||
| 124 | |(% style="width:122px" %)((( | ||
| 125 | **Implemented?** | ||
| 126 | )))|(% style="width:1045px" %)✅ | ||
| 127 | |(% style="width:122px" %)**Comments**|(% style="width:1045px" %)Required header has been set in the **web.config** file of the project | ||
| 128 | |||
| 129 | |||
| 130 | ==== Cookie Without Same Site Attribute ==== | ||
| 131 | |||
| 132 | |(% style="width:122px" %)**Severity**|(% style="width:1045px" %)Low | ||
| 133 | |(% style="width:122px" %)**Description**|(% style="width:1045px" %)A cookie has been set without the SameSite attribute, which means that the cookie can be sent as a result of a 'cross-site' request. The SameSite attribute is an effective counter measure to cross-site request forgery, cross-site script inclusion, and timing attacks | ||
| 134 | |(% style="width:122px" %)**Mitigation**|(% style="width:1045px" %)Ensure that the SameSite attribute is set to either 'lax' or ideally 'strict' for all cookies | ||
| 135 | |(% style="width:122px" %)((( | ||
| 136 | **Implemented?** | ||
| 137 | )))|(% style="width:1045px" %)✅ | ||
| 138 | |(% style="width:122px" %)**Comments**|(% style="width:1045px" %)All cookies created by the application are set using either lax or strict |