From 95388b1f7d727a33f39bc9037ed08de1473756fd Mon Sep 17 00:00:00 2001 From: "s198d.azdo-deployment" Date: Tue, 19 Nov 2024 09:47:46 +0000 Subject: [PATCH] doc: Updated web security scan documentation --- .../security-scan-reports/web-report.md | 2738 ++++++++++++++--- 1 file changed, 2385 insertions(+), 353 deletions(-) diff --git a/documentation/quality-assurance/security-scan-reports/web-report.md b/documentation/quality-assurance/security-scan-reports/web-report.md index 8ca639c72..8441f2a21 100644 --- a/documentation/quality-assurance/security-scan-reports/web-report.md +++ b/documentation/quality-assurance/security-scan-reports/web-report.md @@ -1,6 +1,6 @@ # ZAP Scanning Report -ZAP is supported by the [Crash Override Open Source Fellowship](https://crashoverride.com/?zap=rep). +ZAP by [Checkmarx](https://checkmarx.com/). ## Summary of Alerts @@ -8,9 +8,9 @@ ZAP is supported by the [Crash Override Open Source Fellowship](https://crashove | Risk Level | Number of Alerts | | --- | --- | | High | 0 | -| Medium | 2 | -| Low | 2 | -| Informational | 7 | +| Medium | 3 | +| Low | 6 | +| Informational | 9 | @@ -19,17 +19,24 @@ ZAP is supported by the [Crash Override Open Source Fellowship](https://crashove | Name | Risk Level | Number of Instances | | --- | --- | --- | -| Content Security Policy (CSP) Header Not Set | Medium | 4 | -| Sub Resource Integrity Attribute Missing | Medium | 12 | -| Permissions Policy Header Not Set | Low | 4 | -| Strict-Transport-Security Header Not Set | Low | 4 | -| Base64 Disclosure | Informational | 4 | -| Information Disclosure - Suspicious Comments | Informational | 4 | -| Non-Storable Content | Informational | 4 | -| Sec-Fetch-Dest Header is Missing | Informational | 3 | -| Sec-Fetch-Mode Header is Missing | Informational | 3 | -| Sec-Fetch-Site Header is Missing | Informational | 3 | -| Sec-Fetch-User Header is Missing | Informational | 3 | +| Proxy Disclosure | Medium | 26 | +| Sub Resource Integrity Attribute Missing | Medium | 9 | +| XSLT Injection | Medium | 2 | +| Cookie with SameSite Attribute None | Low | 12 | +| Cross-Domain JavaScript Source File Inclusion | Low | 9 | +| Deprecated Feature Policy Header Set | Low | 11 | +| Private IP Disclosure | Low | 1 | +| Timestamp Disclosure - Unix | Low | 11 | +| X-Content-Type-Options Header Missing | Low | 9 | +| Cookie Slack Detector | Informational | 7 | +| Information Disclosure - Suspicious Comments | Informational | 12 | +| Modern Web Application | Informational | 1 | +| Non-Storable Content | Informational | 2 | +| Re-examine Cache-control Directives | Informational | 8 | +| Session Management Response Identified | Informational | 1 | +| Storable and Cacheable Content | Informational | 11 | +| User Agent Fuzzer | Informational | 194 | +| User Controllable HTML Element Attribute (Potential XSS) | Informational | 2 | @@ -38,65 +45,328 @@ ZAP is supported by the [Crash Override Open Source Fellowship](https://crashove -### [ Content Security Policy (CSP) Header Not Set ](https://www.zaproxy.org/docs/alerts/10038/) +### [ Proxy Disclosure ](https://www.zaproxy.org/docs/alerts/40025/) -##### Medium (High) +##### Medium (Medium) ### Description -Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and embeddable objects such as Java applets, ActiveX, audio and video files. +2 proxy server(s) were detected or fingerprinted. This information helps a potential attacker to determine +- A list of targets for an attack against the application. + - Potential vulnerabilities on the proxy servers that service the application. + - The presence or absence of any proxy-based components that might cause attacks against the application to be detected, prevented, or mitigated. -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/ +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net * Method: `GET` * Parameter: `` - * Attack: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` * Evidence: `` - * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/robots.txt + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/ * Method: `GET` * Parameter: `` - * Attack: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` * Evidence: `` - * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/school/135966 + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/accessibility * Method: `GET` * Parameter: `` - * Attack: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` * Evidence: `` - * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/sitemap.xml + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/assets * Method: `GET` * Parameter: `` - * Attack: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` * Evidence: `` - * Other Info: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/assets/images + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/assets/images/favicon.ico + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/assets/images/favicon.svg + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/assets/images/govuk-icon-180.png + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/assets/images/govuk-icon-mask.svg + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/assets/manifest.json + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/contact + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/cookies + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/cookies%3Fcookies-saved=true + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/css + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/css/front-end.css%3Fv=Fk9S3ib-0VugYDs4FpUNvvAm6JE5yD-W2AFg4drw694 + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/css/main.css%3Fv=UVZegOuzG5lo6RmYvNHND4ImtgfVPUTnYytqhFE7IPk + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/find-organisation + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/js + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/js/front-end.js%3Fv=1GeIUpYa1r7xaoPXlZXIxaLMfkrs9kM5iUMQkRpAreQ + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/js/govuk-frontend.min.js + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/robots.txt + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/school + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/school/135966 + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/sign-in%3FredirectUri=%252F + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/sitemap.xml + * Method: `GET` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/cookies + * Method: `POST` + * Parameter: `` + * Attack: `TRACE, OPTIONS methods with 'Max-Forwards' header. TRACK method.` + * Evidence: `` + * Other Info: `Using the TRACE, OPTIONS, and TRACK methods, the following proxy servers have been identified between ZAP and the application/web server: +- Unknown +- Unknown +The following web/application server has been identified: +- Unknown +` -Instances: 4 +Instances: 26 ### Solution -Ensure that your web server, application server, load balancer, etc. is configured to set the Content-Security-Policy header. +Disable the 'TRACE' method on the proxy servers, as well as the origin web/application server. +Disable the 'OPTIONS' method on the proxy servers, as well as the origin web/application server, if it is not required for other purposes, such as 'CORS' (Cross Origin Resource Sharing). +Configure the web and application servers with custom error pages, to prevent 'fingerprintable' product-specific error pages being leaked to the user in the event of HTTP errors, such as 'TRACK' requests for non-existent pages. +Configure all proxies, application servers, and web servers to prevent disclosure of the technology and version information in the 'Server' and 'X-Powered-By' HTTP response headers. + ### Reference -* [ https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy ](https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy) -* [ https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html ](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html) -* [ https://www.w3.org/TR/CSP/ ](https://www.w3.org/TR/CSP/) -* [ https://w3c.github.io/webappsec-csp/ ](https://w3c.github.io/webappsec-csp/) -* [ https://web.dev/articles/csp ](https://web.dev/articles/csp) -* [ https://caniuse.com/#feat=contentsecuritypolicy ](https://caniuse.com/#feat=contentsecuritypolicy) -* [ https://content-security-policy.com/ ](https://content-security-policy.com/) +* [ https://tools.ietf.org/html/rfc7231#section-5.1.2 ](https://tools.ietf.org/html/rfc7231#section-5.1.2) -#### CWE Id: [ 693 ](https://cwe.mitre.org/data/definitions/693.html) +#### CWE Id: [ 200 ](https://cwe.mitre.org/data/definitions/200.html) -#### WASC Id: 15 +#### WASC Id: 45 -#### Source ID: 3 +#### Source ID: 1 ### [ Sub Resource Integrity Attribute Missing ](https://www.zaproxy.org/docs/alerts/90003/) @@ -106,136 +376,64 @@ Ensure that your web server, application server, load balancer, etc. is configur ### Description -The integrity attribute is missing on a script or link tag served by an external server. The integrity tag prevents an attacker who have gained access to this server from injecting a malicious content. +The integrity attribute is missing on a script or link tag served by an external server. The integrity tag prevents an attacker who have gained access to this server from injecting a malicious content. -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/ - * Method: `GET` - * Parameter: `` - * Attack: `` - * Evidence: `` - * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/ - * Method: `GET` - * Parameter: `` - * Attack: `` - * Evidence: `` - * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/ - * Method: `GET` - * Parameter: `` - * Attack: `` - * Evidence: `` - * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/ +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/ * Method: `GET` * Parameter: `` * Attack: `` - * Evidence: `` + * Evidence: `` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/robots.txt +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/accessibility * Method: `GET` * Parameter: `` * Attack: `` - * Evidence: `` + * Evidence: `` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/robots.txt +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/contact * Method: `GET` * Parameter: `` * Attack: `` - * Evidence: `` + * Evidence: `` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/robots.txt +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/cookies * Method: `GET` * Parameter: `` * Attack: `` - * Evidence: `` + * Evidence: `` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/robots.txt +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/cookies%3Fcookies-saved=true * Method: `GET` * Parameter: `` * Attack: `` - * Evidence: `` + * Evidence: `` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/school/135966 +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/find-organisation * Method: `GET` * Parameter: `` * Attack: `` - * Evidence: `` + * Evidence: `` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/school/135966 +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/robots.txt * Method: `GET` * Parameter: `` * Attack: `` - * Evidence: `` + * Evidence: `` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/school/135966 +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/school/135966 * Method: `GET` * Parameter: `` * Attack: `` - * Evidence: `` + * Evidence: `` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/school/135966 +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/sitemap.xml * Method: `GET` * Parameter: `` * Attack: `` - * Evidence: `` + * Evidence: `` * Other Info: `` -Instances: 12 +Instances: 9 ### Solution @@ -254,484 +452,2318 @@ Provide a valid integrity attribute to the tag. #### Source ID: 3 -### [ Permissions Policy Header Not Set ](https://www.zaproxy.org/docs/alerts/10063/) +### [ XSLT Injection ](https://www.zaproxy.org/docs/alerts/90017/) -##### Low (Medium) +##### Medium (Medium) ### Description -Permissions Policy Header is an added layer of security that helps to restrict from unauthorized access or usage of browser/client features by web resources. This policy ensures the user privacy by limiting or specifying the features of the browsers can be used by the web resources. Permissions Policy provides a set of standard HTTP headers that allow website owners to limit which features of browsers can be used by the page such as camera, microphone, location, full screen etc. +Injection using XSL transformations may be possible, and may allow an attacker to read system information, read and write files, or execute arbitrary code. -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/ - * Method: `GET` - * Parameter: `` - * Attack: `` - * Evidence: `` - * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/robots.txt - * Method: `GET` - * Parameter: `` - * Attack: `` - * Evidence: `` - * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/school/135966 - * Method: `GET` - * Parameter: `` - * Attack: `` - * Evidence: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/cookies + * Method: `POST` + * Parameter: `__RequestVerificationToken` + * Attack: `` + * Evidence: `Microsoft` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/sitemap.xml - * Method: `GET` - * Parameter: `` - * Attack: `` - * Evidence: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/cookies + * Method: `POST` + * Parameter: `AnalyticsCookiesEnabled` + * Attack: `` + * Evidence: `Microsoft` * Other Info: `` -Instances: 4 +Instances: 2 ### Solution -Ensure that your web server, application server, load balancer, etc. is configured to set the Permissions-Policy header. +Sanitize and analyze every user input coming from any client-side. ### Reference -* [ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy ](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy) -* [ https://developer.chrome.com/blog/feature-policy/ ](https://developer.chrome.com/blog/feature-policy/) -* [ https://scotthelme.co.uk/a-new-security-header-feature-policy/ ](https://scotthelme.co.uk/a-new-security-header-feature-policy/) -* [ https://w3c.github.io/webappsec-feature-policy/ ](https://w3c.github.io/webappsec-feature-policy/) -* [ https://www.smashingmagazine.com/2018/12/feature-policy/ ](https://www.smashingmagazine.com/2018/12/feature-policy/) +* [ https://www.contextis.com/blog/xslt-server-side-injection-attacks ](https://www.contextis.com/blog/xslt-server-side-injection-attacks) -#### CWE Id: [ 693 ](https://cwe.mitre.org/data/definitions/693.html) +#### CWE Id: [ 91 ](https://cwe.mitre.org/data/definitions/91.html) -#### WASC Id: 15 +#### WASC Id: 23 -#### Source ID: 3 +#### Source ID: 1 -### [ Strict-Transport-Security Header Not Set ](https://www.zaproxy.org/docs/alerts/10035/) +### [ Cookie with SameSite Attribute None ](https://www.zaproxy.org/docs/alerts/10054/) -##### Low (High) +##### Low (Medium) ### Description -HTTP Strict Transport Security (HSTS) is a web security policy mechanism whereby a web server declares that complying user agents (such as a web browser) are to interact with it using only secure HTTPS connections (i.e. HTTP layered over TLS/SSL). HSTS is an IETF standards track protocol and is specified in RFC 6797. +A cookie has been set with its SameSite attribute set to "none", which means that the cookie can be sent as a result of a 'cross-site' request. The SameSite attribute is an effective counter measure to cross-site request forgery, cross-site script inclusion, and timing attacks. -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/ +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/sign-in%3FredirectUri=%252F * Method: `GET` - * Parameter: `` + * Parameter: `.AspNetCore.Correlation.9tGXT24RoZ27bsvS--X-xjmpSiJSo3-SauJrCO4sT10` * Attack: `` - * Evidence: `` + * Evidence: `Set-Cookie: .AspNetCore.Correlation.9tGXT24RoZ27bsvS--X-xjmpSiJSo3-SauJrCO4sT10` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/robots.txt +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/sign-in%3FredirectUri=%252F * Method: `GET` - * Parameter: `` + * Parameter: `.AspNetCore.OpenIdConnect.Nonce.CfDJ8Epa28AQ8o1JszkO6BYP-bqS4mcOJXgNsU7e4Ki-K3PqLlZv4wyJsEQg0IFUYuJRt_flNCyqhNjXEQCaIHplMLlA80rObAKbIn7O_I5CZdx_aqJNzhQBfoP6QmJ4dMZ_ApW-7Nuykyu4BylTpH8eLdb9-wjtx16oZ0xFySYO4XImgG3mobHOMXAp6FdTdaw8J1RMg2p1C1Im6AeeVXQdMh1xE8brol7nXCAMCqoqU99JNmCOZbdvD07J6KlVh3ubne2DFJW5YAmKNwFspv5DcDI` * Attack: `` - * Evidence: `` + * Evidence: `Set-Cookie: .AspNetCore.OpenIdConnect.Nonce.CfDJ8Epa28AQ8o1JszkO6BYP-bqS4mcOJXgNsU7e4Ki-K3PqLlZv4wyJsEQg0IFUYuJRt_flNCyqhNjXEQCaIHplMLlA80rObAKbIn7O_I5CZdx_aqJNzhQBfoP6QmJ4dMZ_ApW-7Nuykyu4BylTpH8eLdb9-wjtx16oZ0xFySYO4XImgG3mobHOMXAp6FdTdaw8J1RMg2p1C1Im6AeeVXQdMh1xE8brol7nXCAMCqoqU99JNmCOZbdvD07J6KlVh3ubne2DFJW5YAmKNwFspv5DcDI` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/school/135966 +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/sign-in%3FredirectUri=%252Faccessibility * Method: `GET` - * Parameter: `` + * Parameter: `.AspNetCore.Correlation.Zd6QHXMh8jzGveik3AINl6QlPQJlAHJv4R4RFmht65g` * Attack: `` - * Evidence: `` + * Evidence: `Set-Cookie: .AspNetCore.Correlation.Zd6QHXMh8jzGveik3AINl6QlPQJlAHJv4R4RFmht65g` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/sitemap.xml +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/sign-in%3FredirectUri=%252Faccessibility * Method: `GET` - * Parameter: `` + * Parameter: `.AspNetCore.OpenIdConnect.Nonce.CfDJ8Epa28AQ8o1JszkO6BYP-bptWEH414P7lyJw1vJgzg6M_TclZcIrrZqsM6YaBy23wsxgEJtKDSpmko2fUOZejQAuINHq1ypOlLTkE9gRfyxWLxKLAZQLf3uW_NyUICF6ngK9fyfAQqQDxqtMF7Xnu7jQZk0GkzE66Jy2P2XfWt9lKNaDcQ3Txkvwt5-sZ9V951m2pv24c7Gbn8loXh4jfvvso4OfXfYwNtDx0Nnk_deKFgXnV2uKdeCPh3Tlg0nB16crFTKju1t3E_gVLNR3aKE` * Attack: `` - * Evidence: `` + * Evidence: `Set-Cookie: .AspNetCore.OpenIdConnect.Nonce.CfDJ8Epa28AQ8o1JszkO6BYP-bptWEH414P7lyJw1vJgzg6M_TclZcIrrZqsM6YaBy23wsxgEJtKDSpmko2fUOZejQAuINHq1ypOlLTkE9gRfyxWLxKLAZQLf3uW_NyUICF6ngK9fyfAQqQDxqtMF7Xnu7jQZk0GkzE66Jy2P2XfWt9lKNaDcQ3Txkvwt5-sZ9V951m2pv24c7Gbn8loXh4jfvvso4OfXfYwNtDx0Nnk_deKFgXnV2uKdeCPh3Tlg0nB16crFTKju1t3E_gVLNR3aKE` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/sign-in%3FredirectUri=%252Fcontact + * Method: `GET` + * Parameter: `.AspNetCore.Correlation.4S7Tu1N75AFpoOH-R5ffEksHFLeXyintN1JTNdzY_q8` + * Attack: `` + * Evidence: `Set-Cookie: .AspNetCore.Correlation.4S7Tu1N75AFpoOH-R5ffEksHFLeXyintN1JTNdzY_q8` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/sign-in%3FredirectUri=%252Fcontact + * Method: `GET` + * Parameter: `.AspNetCore.OpenIdConnect.Nonce.CfDJ8Epa28AQ8o1JszkO6BYP-bpRu8uIYgZ0jRdnqd14hWS1TuiU8k3OBRlh-pkiyqfOYlqO5n2edTX8TxYfo1TZ0Ml-d6dYgQqBKPNNVIQMiqdeV771fbmyASSAJZojzwbePs9VhfGvBGUM42yMnpu_9WCQpOek4RMjcFGLqIHdqNC4W_kd3AFkKC9tCDzlcGY_B4z6DUmzbAP0gmSumKezaAi8YNpKbFzAWd5MfHXMxu1DXIlb8O9a6dhImsYXl-2weKpPZZm1Dfnf73VDC-TK4io` + * Attack: `` + * Evidence: `Set-Cookie: .AspNetCore.OpenIdConnect.Nonce.CfDJ8Epa28AQ8o1JszkO6BYP-bpRu8uIYgZ0jRdnqd14hWS1TuiU8k3OBRlh-pkiyqfOYlqO5n2edTX8TxYfo1TZ0Ml-d6dYgQqBKPNNVIQMiqdeV771fbmyASSAJZojzwbePs9VhfGvBGUM42yMnpu_9WCQpOek4RMjcFGLqIHdqNC4W_kd3AFkKC9tCDzlcGY_B4z6DUmzbAP0gmSumKezaAi8YNpKbFzAWd5MfHXMxu1DXIlb8O9a6dhImsYXl-2weKpPZZm1Dfnf73VDC-TK4io` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/sign-in%3FredirectUri=%252Fcookies + * Method: `GET` + * Parameter: `.AspNetCore.Correlation.xf-4JgEOkgBqzXC3SGHe7ntjcmgIMTEH2AAOY5pGIM0` + * Attack: `` + * Evidence: `Set-Cookie: .AspNetCore.Correlation.xf-4JgEOkgBqzXC3SGHe7ntjcmgIMTEH2AAOY5pGIM0` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/sign-in%3FredirectUri=%252Fcookies + * Method: `GET` + * Parameter: `.AspNetCore.OpenIdConnect.Nonce.CfDJ8Epa28AQ8o1JszkO6BYP-bp0D7-Y_LpM9dIxNOcZXsZilPU3dNG-HUzEe4EbqxJM-OGVjxEUFtwZwePAsc4O3ObOlnf29rtrA0TIL0oqxGB8GyHBRfgX9nalEmvJt7Zm2LRL-rAeDngsd7oVMYZtJsEO1-VtoH6UPJyWMm4jHNOsAJ5LQvOmozRvMni1PMW9UEKRuD0TLpYtWWu3FaTgL5IX5tanVEhvl0HTHKUl0T6lsr4pRY9PSxiuBUHclDnMiRTbkHXT2TpEgZC28Bh6IEg` + * Attack: `` + * Evidence: `Set-Cookie: .AspNetCore.OpenIdConnect.Nonce.CfDJ8Epa28AQ8o1JszkO6BYP-bp0D7-Y_LpM9dIxNOcZXsZilPU3dNG-HUzEe4EbqxJM-OGVjxEUFtwZwePAsc4O3ObOlnf29rtrA0TIL0oqxGB8GyHBRfgX9nalEmvJt7Zm2LRL-rAeDngsd7oVMYZtJsEO1-VtoH6UPJyWMm4jHNOsAJ5LQvOmozRvMni1PMW9UEKRuD0TLpYtWWu3FaTgL5IX5tanVEhvl0HTHKUl0T6lsr4pRY9PSxiuBUHclDnMiRTbkHXT2TpEgZC28Bh6IEg` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/sign-in%3FredirectUri=%252Ferror%252F404 + * Method: `GET` + * Parameter: `.AspNetCore.Correlation.iMbFuaYkj9sKAlVVxftBRCnHhMzF6MtrZhlLatNnCKk` + * Attack: `` + * Evidence: `Set-Cookie: .AspNetCore.Correlation.iMbFuaYkj9sKAlVVxftBRCnHhMzF6MtrZhlLatNnCKk` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/sign-in%3FredirectUri=%252Ferror%252F404 + * Method: `GET` + * Parameter: `.AspNetCore.OpenIdConnect.Nonce.CfDJ8Epa28AQ8o1JszkO6BYP-bra8z-eEevdkisRGR6w7bO24rhvQTlK-yYjvdlA8FghLDWz81HU-YKm5ApmtE6uZTYck4_O2Iz3aCOSNddTwTbEXII9kRerKpXZR5xJ-6HM8LgH3hPRxRE2lAF1uL1D_zeDuz_MliAP4xZHsvqDdSLj7YszDW4Rnmi5djXTVooL_FdT6NT0q-vbb8kfp6ai9FJB_q4BqSKcTJ9kb7KvQBvdpXUaJYUzS_OgaOEGrmwClBNTRLkv3b09RNnwBOsnSwI` + * Attack: `` + * Evidence: `Set-Cookie: .AspNetCore.OpenIdConnect.Nonce.CfDJ8Epa28AQ8o1JszkO6BYP-bra8z-eEevdkisRGR6w7bO24rhvQTlK-yYjvdlA8FghLDWz81HU-YKm5ApmtE6uZTYck4_O2Iz3aCOSNddTwTbEXII9kRerKpXZR5xJ-6HM8LgH3hPRxRE2lAF1uL1D_zeDuz_MliAP4xZHsvqDdSLj7YszDW4Rnmi5djXTVooL_FdT6NT0q-vbb8kfp6ai9FJB_q4BqSKcTJ9kb7KvQBvdpXUaJYUzS_OgaOEGrmwClBNTRLkv3b09RNnwBOsnSwI` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/sign-in%3FredirectUri=%252Ffind-organisation + * Method: `GET` + * Parameter: `.AspNetCore.Correlation.lwQrB9GPKMvIlDtVj92AytimwksaQYDfrgnCIa_-W9c` + * Attack: `` + * Evidence: `Set-Cookie: .AspNetCore.Correlation.lwQrB9GPKMvIlDtVj92AytimwksaQYDfrgnCIa_-W9c` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/sign-in%3FredirectUri=%252Ffind-organisation + * Method: `GET` + * Parameter: `.AspNetCore.OpenIdConnect.Nonce.CfDJ8Epa28AQ8o1JszkO6BYP-bqeLkXqHK7Mq6iz2B16k5ilroMqGiY50S47y22Q25Xl0F6kOyDhN6g9GiR9fYvznUBhbGsCPplXtxStA7-cApuLt_ixXzD17gJnW2lvMD5tv0PlLLN7_4WZOO1Ooi_fExVjH06eoais1espQwiKy4McxCoAO0Bix6tQKuVOZ08zWKRam7Zy07elbnKm3xr2SDpZkh9mvoIJx85d-_4V7LuS9OwCGsCEofrz0-CkuWs0x8CZNKSi73ZIPQYHZhHNB50` + * Attack: `` + * Evidence: `Set-Cookie: .AspNetCore.OpenIdConnect.Nonce.CfDJ8Epa28AQ8o1JszkO6BYP-bqeLkXqHK7Mq6iz2B16k5ilroMqGiY50S47y22Q25Xl0F6kOyDhN6g9GiR9fYvznUBhbGsCPplXtxStA7-cApuLt_ixXzD17gJnW2lvMD5tv0PlLLN7_4WZOO1Ooi_fExVjH06eoais1espQwiKy4McxCoAO0Bix6tQKuVOZ08zWKRam7Zy07elbnKm3xr2SDpZkh9mvoIJx85d-_4V7LuS9OwCGsCEofrz0-CkuWs0x8CZNKSi73ZIPQYHZhHNB50` * Other Info: `` -Instances: 4 +Instances: 12 ### Solution -Ensure that your web server, application server, load balancer, etc. is configured to enforce Strict-Transport-Security. +Ensure that the SameSite attribute is set to either 'lax' or ideally 'strict' for all cookies. ### Reference -* [ https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html ](https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html) -* [ https://owasp.org/www-community/Security_Headers ](https://owasp.org/www-community/Security_Headers) -* [ https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security ](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) -* [ https://caniuse.com/stricttransportsecurity ](https://caniuse.com/stricttransportsecurity) -* [ https://datatracker.ietf.org/doc/html/rfc6797 ](https://datatracker.ietf.org/doc/html/rfc6797) +* [ https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site ](https://tools.ietf.org/html/draft-ietf-httpbis-cookie-same-site) -#### CWE Id: [ 319 ](https://cwe.mitre.org/data/definitions/319.html) +#### CWE Id: [ 1275 ](https://cwe.mitre.org/data/definitions/1275.html) -#### WASC Id: 15 +#### WASC Id: 13 #### Source ID: 3 -### [ Base64 Disclosure ](https://www.zaproxy.org/docs/alerts/10094/) +### [ Cross-Domain JavaScript Source File Inclusion ](https://www.zaproxy.org/docs/alerts/10017/) -##### Informational (Medium) +##### Low (Medium) ### Description -Base64 encoded data was disclosed by the application/web server. Note: in the interests of performance not all base64 strings in the response were analyzed individually, the entire response should be looked at by the analyst/security team/developer(s). +The page includes one or more script files from a third-party domain. -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/ +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/ * Method: `GET` - * Parameter: `` + * Parameter: `https://js.monitor.azure.com/scripts/b/ext/ai.clck.2.min.js` * Attack: `` - * Evidence: `net/pages/PageNotFound_files/UxFxErrorCss_8097D4DBB3B4874308CB3816C1762BED98637360` + * Evidence: `` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/robots.txt +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/accessibility * Method: `GET` - * Parameter: `` + * Parameter: `https://js.monitor.azure.com/scripts/b/ext/ai.clck.2.min.js` * Attack: `` - * Evidence: `net/pages/PageNotFound_files/UxFxErrorCss_8097D4DBB3B4874308CB3816C1762BED98637360` + * Evidence: `` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/school/135966 +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/contact * Method: `GET` - * Parameter: `` + * Parameter: `https://js.monitor.azure.com/scripts/b/ext/ai.clck.2.min.js` * Attack: `` - * Evidence: `net/pages/PageNotFound_files/UxFxErrorCss_8097D4DBB3B4874308CB3816C1762BED98637360` + * Evidence: `` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/sitemap.xml +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/cookies * Method: `GET` - * Parameter: `` + * Parameter: `https://js.monitor.azure.com/scripts/b/ext/ai.clck.2.min.js` + * Attack: `` + * Evidence: `` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/cookies%3Fcookies-saved=true + * Method: `GET` + * Parameter: `https://js.monitor.azure.com/scripts/b/ext/ai.clck.2.min.js` + * Attack: `` + * Evidence: `` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/find-organisation + * Method: `GET` + * Parameter: `https://js.monitor.azure.com/scripts/b/ext/ai.clck.2.min.js` + * Attack: `` + * Evidence: `` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/robots.txt + * Method: `GET` + * Parameter: `https://js.monitor.azure.com/scripts/b/ext/ai.clck.2.min.js` + * Attack: `` + * Evidence: `` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/school/135966 + * Method: `GET` + * Parameter: `https://js.monitor.azure.com/scripts/b/ext/ai.clck.2.min.js` + * Attack: `` + * Evidence: `` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/sitemap.xml + * Method: `GET` + * Parameter: `https://js.monitor.azure.com/scripts/b/ext/ai.clck.2.min.js` * Attack: `` - * Evidence: `net/pages/PageNotFound_files/UxFxErrorCss_8097D4DBB3B4874308CB3816C1762BED98637360` + * Evidence: `` * Other Info: `` -Instances: 4 +Instances: 9 ### Solution -Manually confirm that the Base64 data does not leak sensitive information, and that the data cannot be aggregated/used to exploit other vulnerabilities. +Ensure JavaScript source files are loaded from only trusted sources, and the sources can't be controlled by end users of the application. ### Reference -* [ https://projects.webappsec.org/w/page/13246936/Information%20Leakage ](https://projects.webappsec.org/w/page/13246936/Information%20Leakage) - -#### CWE Id: [ 200 ](https://cwe.mitre.org/data/definitions/200.html) +#### CWE Id: [ 829 ](https://cwe.mitre.org/data/definitions/829.html) -#### WASC Id: 13 +#### WASC Id: 15 #### Source ID: 3 -### [ Information Disclosure - Suspicious Comments ](https://www.zaproxy.org/docs/alerts/10027/) +### [ Deprecated Feature Policy Header Set ](https://www.zaproxy.org/docs/alerts/10063/) -##### Informational (Medium) +##### Low (Medium) ### Description -The response appears to contain suspicious comments which may help an attacker. Note: Matches made within script blocks or files are against the entire content not only comments. +The header has now been renamed to Permissions-Policy. -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/ +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/ * Method: `GET` * Parameter: `` * Attack: `` - * Evidence: `from` + * Evidence: `Feature-Policy` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/robots.txt +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/accessibility * Method: `GET` * Parameter: `` * Attack: `` - * Evidence: `from` + * Evidence: `Feature-Policy` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/school/135966 +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/contact * Method: `GET` * Parameter: `` * Attack: `` - * Evidence: `from` + * Evidence: `Feature-Policy` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/sitemap.xml +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/cookies * Method: `GET` * Parameter: `` * Attack: `` - * Evidence: `from` + * Evidence: `Feature-Policy` * Other Info: `` - -Instances: 4 - -### Solution - -Remove all comments that return information that may help an attacker and fix any underlying problems they refer to. - -### Reference - - - -#### CWE Id: [ 200 ](https://cwe.mitre.org/data/definitions/200.html) - - -#### WASC Id: 13 - -#### Source ID: 3 - -### [ Non-Storable Content ](https://www.zaproxy.org/docs/alerts/10049/) - - - -##### Informational (Medium) - -### Description - -The response contents are not storable by caching components such as proxy servers. If the response does not contain sensitive, personal or user-specific information, it may benefit from being stored and cached, to improve performance. - -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/ +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/cookies%3Fcookies-saved=true + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `Feature-Policy` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/find-organisation + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `Feature-Policy` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/js/front-end.js%3Fv=1GeIUpYa1r7xaoPXlZXIxaLMfkrs9kM5iUMQkRpAreQ + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `Feature-Policy` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/js/govuk-frontend.min.js * Method: `GET` * Parameter: `` * Attack: `` - * Evidence: `no-store` + * Evidence: `Feature-Policy` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/robots.txt +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/robots.txt * Method: `GET` * Parameter: `` * Attack: `` - * Evidence: `no-store` + * Evidence: `Feature-Policy` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/school/135966 +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/school/135966 * Method: `GET` * Parameter: `` * Attack: `` - * Evidence: `no-store` + * Evidence: `Feature-Policy` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/sitemap.xml +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/sitemap.xml * Method: `GET` * Parameter: `` * Attack: `` - * Evidence: `no-store` + * Evidence: `Feature-Policy` * Other Info: `` -Instances: 4 +Instances: 11 ### Solution -The content may be marked as storable by ensuring that the following conditions are satisfied: -The request method must be understood by the cache and defined as being cacheable ("GET", "HEAD", and "POST" are currently defined as cacheable) -The response status code must be understood by the cache (one of the 1XX, 2XX, 3XX, 4XX, or 5XX response classes are generally understood) -The "no-store" cache directive must not appear in the request or response header fields -For caching by "shared" caches such as "proxy" caches, the "private" response directive must not appear in the response -For caching by "shared" caches such as "proxy" caches, the "Authorization" header field must not appear in the request, unless the response explicitly allows it (using one of the "must-revalidate", "public", or "s-maxage" Cache-Control response directives) -In addition to the conditions above, at least one of the following conditions must also be satisfied by the response: -It must contain an "Expires" header field -It must contain a "max-age" response directive -For "shared" caches such as "proxy" caches, it must contain a "s-maxage" response directive -It must contain a "Cache Control Extension" that allows it to be cached -It must have a status code that is defined as cacheable by default (200, 203, 204, 206, 300, 301, 404, 405, 410, 414, 501). +Ensure that your web server, application server, load balancer, etc. is configured to set the Permissions-Policy header instead of the Feature-Policy header. ### Reference -* [ https://datatracker.ietf.org/doc/html/rfc7234 ](https://datatracker.ietf.org/doc/html/rfc7234) -* [ https://datatracker.ietf.org/doc/html/rfc7231 ](https://datatracker.ietf.org/doc/html/rfc7231) -* [ https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html ](https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html) +* [ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy ](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy) +* [ https://scotthelme.co.uk/goodbye-feature-policy-and-hello-permissions-policy/ ](https://scotthelme.co.uk/goodbye-feature-policy-and-hello-permissions-policy/) -#### CWE Id: [ 524 ](https://cwe.mitre.org/data/definitions/524.html) +#### CWE Id: [ 16 ](https://cwe.mitre.org/data/definitions/16.html) -#### WASC Id: 13 +#### WASC Id: 15 #### Source ID: 3 -### [ Sec-Fetch-Dest Header is Missing ](https://www.zaproxy.org/docs/alerts/90005/) +### [ Private IP Disclosure ](https://www.zaproxy.org/docs/alerts/2/) -##### Informational (High) +##### Low (Medium) ### Description -Specifies how and where the data would be used. For instance, if the value is audio, then the requested resource must be audio data and not any other type of resource. +A private IP (such as 10.x.x.x, 172.x.x.x, 192.168.x.x) or an Amazon EC2 private hostname (for example, ip-10-0-56-78) has been found in the HTTP response body. This information might be helpful for further attacks targeting internal systems. -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/ - * Method: `GET` - * Parameter: `Sec-Fetch-Dest` - * Attack: `` - * Evidence: `` - * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/robots.txt - * Method: `GET` - * Parameter: `Sec-Fetch-Dest` - * Attack: `` - * Evidence: `` - * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/school/135966 +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/assets/images/favicon.svg * Method: `GET` - * Parameter: `Sec-Fetch-Dest` + * Parameter: `` * Attack: `` - * Evidence: `` - * Other Info: `` + * Evidence: `10.02.68.86` + * Other Info: `10.02.68.86 +` -Instances: 3 +Instances: 1 ### Solution -Ensure that Sec-Fetch-Dest header is included in request headers. +Remove the private IP address from the HTTP response body. For comments, use JSP/ASP/PHP comment instead of HTML/JavaScript comment which can be seen by client browsers. ### Reference -* [ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Dest ](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Dest) +* [ https://tools.ietf.org/html/rfc1918 ](https://tools.ietf.org/html/rfc1918) -#### CWE Id: [ 352 ](https://cwe.mitre.org/data/definitions/352.html) +#### CWE Id: [ 200 ](https://cwe.mitre.org/data/definitions/200.html) -#### WASC Id: 9 +#### WASC Id: 13 #### Source ID: 3 -### [ Sec-Fetch-Mode Header is Missing ](https://www.zaproxy.org/docs/alerts/90005/) +### [ Timestamp Disclosure - Unix ](https://www.zaproxy.org/docs/alerts/10096/) -##### Informational (High) +##### Low (Low) ### Description -Allows to differentiate between requests for navigating between HTML pages and requests for loading resources like images, audio etc. +A timestamp was disclosed by the application/web server. - Unix -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/ +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/css/main.css%3Fv=UVZegOuzG5lo6RmYvNHND4ImtgfVPUTnYytqhFE7IPk * Method: `GET` - * Parameter: `Sec-Fetch-Mode` + * Parameter: `` * Attack: `` - * Evidence: `` + * Evidence: `1428571429` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/robots.txt +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/js/front-end.js%3Fv=1GeIUpYa1r7xaoPXlZXIxaLMfkrs9kM5iUMQkRpAreQ * Method: `GET` - * Parameter: `Sec-Fetch-Mode` + * Parameter: `` * Attack: `` - * Evidence: `` + * Evidence: `1433087999` * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/school/135966 +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/js/front-end.js%3Fv=1GeIUpYa1r7xaoPXlZXIxaLMfkrs9kM5iUMQkRpAreQ * Method: `GET` - * Parameter: `Sec-Fetch-Mode` + * Parameter: `` * Attack: `` - * Evidence: `` + * Evidence: `1604231423` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/js/front-end.js%3Fv=1GeIUpYa1r7xaoPXlZXIxaLMfkrs9kM5iUMQkRpAreQ + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `1687547391` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/js/front-end.js%3Fv=1GeIUpYa1r7xaoPXlZXIxaLMfkrs9kM5iUMQkRpAreQ + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `1714657791` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/js/front-end.js%3Fv=1GeIUpYa1r7xaoPXlZXIxaLMfkrs9kM5iUMQkRpAreQ + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `1724754687` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/js/front-end.js%3Fv=1GeIUpYa1r7xaoPXlZXIxaLMfkrs9kM5iUMQkRpAreQ + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `1768516095` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/js/front-end.js%3Fv=1GeIUpYa1r7xaoPXlZXIxaLMfkrs9kM5iUMQkRpAreQ + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `1784335871` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/js/front-end.js%3Fv=1GeIUpYa1r7xaoPXlZXIxaLMfkrs9kM5iUMQkRpAreQ + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `1804477439` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/js/front-end.js%3Fv=1GeIUpYa1r7xaoPXlZXIxaLMfkrs9kM5iUMQkRpAreQ + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `1887473919` + * Other Info: `` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/js/front-end.js%3Fv=1GeIUpYa1r7xaoPXlZXIxaLMfkrs9kM5iUMQkRpAreQ + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `2005441023` * Other Info: `` -Instances: 3 +Instances: 11 ### Solution -Ensure that Sec-Fetch-Mode header is included in request headers. +Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns. ### Reference -* [ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Mode ](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Mode) +* [ https://cwe.mitre.org/data/definitions/200.html ](https://cwe.mitre.org/data/definitions/200.html) -#### CWE Id: [ 352 ](https://cwe.mitre.org/data/definitions/352.html) +#### CWE Id: [ 200 ](https://cwe.mitre.org/data/definitions/200.html) -#### WASC Id: 9 +#### WASC Id: 13 #### Source ID: 3 -### [ Sec-Fetch-Site Header is Missing ](https://www.zaproxy.org/docs/alerts/90005/) +### [ X-Content-Type-Options Header Missing ](https://www.zaproxy.org/docs/alerts/10021/) -##### Informational (High) +##### Low (Medium) ### Description -Specifies the relationship between request initiator's origin and target's origin. +The Anti-MIME-Sniffing header X-Content-Type-Options was not set to 'nosniff'. This allows older versions of Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response body to be interpreted and displayed as a content type other than the declared content type. Current (early 2014) and legacy versions of Firefox will use the declared content type (if one is set), rather than performing MIME-sniffing. -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/ +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/assets/images/favicon.ico * Method: `GET` - * Parameter: `Sec-Fetch-Site` + * Parameter: `x-content-type-options` * Attack: `` * Evidence: `` - * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/robots.txt + * Other Info: `This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type. +At "High" threshold this scan rule will not alert on client or server error responses.` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/assets/images/favicon.svg * Method: `GET` - * Parameter: `Sec-Fetch-Site` + * Parameter: `x-content-type-options` * Attack: `` * Evidence: `` - * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/school/135966 + * Other Info: `This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type. +At "High" threshold this scan rule will not alert on client or server error responses.` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/assets/images/govuk-icon-180.png * Method: `GET` - * Parameter: `Sec-Fetch-Site` + * Parameter: `x-content-type-options` * Attack: `` * Evidence: `` - * Other Info: `` + * Other Info: `This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type. +At "High" threshold this scan rule will not alert on client or server error responses.` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/assets/images/govuk-icon-mask.svg + * Method: `GET` + * Parameter: `x-content-type-options` + * Attack: `` + * Evidence: `` + * Other Info: `This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type. +At "High" threshold this scan rule will not alert on client or server error responses.` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/assets/manifest.json + * Method: `GET` + * Parameter: `x-content-type-options` + * Attack: `` + * Evidence: `` + * Other Info: `This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type. +At "High" threshold this scan rule will not alert on client or server error responses.` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/css/front-end.css%3Fv=Fk9S3ib-0VugYDs4FpUNvvAm6JE5yD-W2AFg4drw694 + * Method: `GET` + * Parameter: `x-content-type-options` + * Attack: `` + * Evidence: `` + * Other Info: `This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type. +At "High" threshold this scan rule will not alert on client or server error responses.` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/css/main.css%3Fv=UVZegOuzG5lo6RmYvNHND4ImtgfVPUTnYytqhFE7IPk + * Method: `GET` + * Parameter: `x-content-type-options` + * Attack: `` + * Evidence: `` + * Other Info: `This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type. +At "High" threshold this scan rule will not alert on client or server error responses.` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/js/front-end.js%3Fv=1GeIUpYa1r7xaoPXlZXIxaLMfkrs9kM5iUMQkRpAreQ + * Method: `GET` + * Parameter: `x-content-type-options` + * Attack: `` + * Evidence: `` + * Other Info: `This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type. +At "High" threshold this scan rule will not alert on client or server error responses.` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/js/govuk-frontend.min.js + * Method: `GET` + * Parameter: `x-content-type-options` + * Attack: `` + * Evidence: `` + * Other Info: `This issue still applies to error type pages (401, 403, 500, etc.) as those pages are often still affected by injection issues, in which case there is still concern for browsers sniffing pages away from their actual content type. +At "High" threshold this scan rule will not alert on client or server error responses.` -Instances: 3 +Instances: 9 ### Solution -Ensure that Sec-Fetch-Site header is included in request headers. +Ensure that the application/web server sets the Content-Type header appropriately, and that it sets the X-Content-Type-Options header to 'nosniff' for all web pages. +If possible, ensure that the end user uses a standards-compliant and modern web browser that does not perform MIME-sniffing at all, or that can be directed by the web application/web server to not perform MIME-sniffing. ### Reference -* [ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Site ](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Site) +* [ https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/compatibility/gg622941(v=vs.85) ](https://learn.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/compatibility/gg622941(v=vs.85)) +* [ https://owasp.org/www-community/Security_Headers ](https://owasp.org/www-community/Security_Headers) -#### CWE Id: [ 352 ](https://cwe.mitre.org/data/definitions/352.html) +#### CWE Id: [ 693 ](https://cwe.mitre.org/data/definitions/693.html) -#### WASC Id: 9 +#### WASC Id: 15 #### Source ID: 3 -### [ Sec-Fetch-User Header is Missing ](https://www.zaproxy.org/docs/alerts/90005/) +### [ Cookie Slack Detector ](https://www.zaproxy.org/docs/alerts/90027/) -##### Informational (High) +##### Informational (Low) ### Description -Specifies if a navigation request was initiated by a user. +Repeated GET requests: drop a different cookie each time, followed by normal request with all cookies to stabilize session, compare responses against original baseline GET. This can reveal areas where cookie based authentication/attributes are not actually enforced. -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/ +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/assets/images/favicon.svg * Method: `GET` - * Parameter: `Sec-Fetch-User` + * Parameter: `` * Attack: `` * Evidence: `` - * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/robots.txt + * Other Info: `Cookies that don't have expected effects can reveal flaws in application logic. In the worst case, this can reveal where authentication via cookie token(s) is not actually enforced. +These cookies affected the response: +These cookies did NOT affect the response: .AspNetCore.Antiforgery.cdV5uW_Ejgc +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/cookies * Method: `GET` - * Parameter: `Sec-Fetch-User` + * Parameter: `` * Attack: `` * Evidence: `` - * Other Info: `` -* URL: https://s198d01-education-benchmarking-fd.azurefd.net/school/135966 + * Other Info: `Dropping this cookie appears to have invalidated the session: [.AspNetCore.Mvc.CookieTempDataProvider] A follow-on request with all original cookies still had a different response than the original request. +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/cookies%3Fcookies-saved=true + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `` + * Other Info: `Cookies that don't have expected effects can reveal flaws in application logic. In the worst case, this can reveal where authentication via cookie token(s) is not actually enforced. +These cookies affected the response: cookie_policy +These cookies did NOT affect the response: .AspNetCore.Antiforgery.cdV5uW_Ejgc,.AspNetCore.Mvc.CookieTempDataProvider +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/js/front-end.js%3Fv=1GeIUpYa1r7xaoPXlZXIxaLMfkrs9kM5iUMQkRpAreQ + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `` + * Other Info: `Cookies that don't have expected effects can reveal flaws in application logic. In the worst case, this can reveal where authentication via cookie token(s) is not actually enforced. +These cookies affected the response: +These cookies did NOT affect the response: .AspNetCore.Antiforgery.cdV5uW_Ejgc +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/js/govuk-frontend.min.js + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `` + * Other Info: `Cookies that don't have expected effects can reveal flaws in application logic. In the worst case, this can reveal where authentication via cookie token(s) is not actually enforced. +These cookies affected the response: +These cookies did NOT affect the response: .AspNetCore.Antiforgery.cdV5uW_Ejgc +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/sign-in%3FredirectUri=%252F * Method: `GET` - * Parameter: `Sec-Fetch-User` + * Parameter: `` + * Attack: `` + * Evidence: `` + * Other Info: `Cookies that don't have expected effects can reveal flaws in application logic. In the worst case, this can reveal where authentication via cookie token(s) is not actually enforced. +These cookies affected the response: +These cookies did NOT affect the response: .AspNetCore.Correlation.9tGXT24RoZ27bsvS--X-xjmpSiJSo3-SauJrCO4sT10,.AspNetCore.OpenIdConnect.Nonce.CfDJ8Epa28AQ8o1JszkO6BYP-bqS4mcOJXgNsU7e4Ki-K3PqLlZv4wyJsEQg0IFUYuJRt_flNCyqhNjXEQCaIHplMLlA80rObAKbIn7O_I5CZdx_aqJNzhQBfoP6QmJ4dMZ_ApW-7Nuykyu4BylTpH8eLdb9-wjtx16oZ0xFySYO4XImgG3mobHOMXAp6FdTdaw8J1RMg2p1C1Im6AeeVXQdMh1xE8brol7nXCAMCqoqU99JNmCOZbdvD07J6KlVh3ubne2DFJW5YAmKNwFspv5DcDI +` +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/cookies + * Method: `POST` + * Parameter: `` * Attack: `` * Evidence: `` + * Other Info: `Cookies that don't have expected effects can reveal flaws in application logic. In the worst case, this can reveal where authentication via cookie token(s) is not actually enforced. +These cookies affected the response: +These cookies did NOT affect the response: .AspNetCore.Antiforgery.cdV5uW_Ejgc,cookie_policy +` + +Instances: 7 + +### Solution + + + +### Reference + + +* [ https://cwe.mitre.org/data/definitions/205.html ](https://cwe.mitre.org/data/definitions/205.html) + + +#### CWE Id: [ 205 ](https://cwe.mitre.org/data/definitions/205.html) + + +#### WASC Id: 45 + +#### Source ID: 1 + +### [ Information Disclosure - Suspicious Comments ](https://www.zaproxy.org/docs/alerts/10027/) + + + +##### Informational (Low) + +### Description + +The response appears to contain suspicious comments which may help an attacker. Note: Matches made within script blocks or files are against the entire content not only comments. + +* URL: https://s198d01-education-benchmarking-d8a2cna4f9btahaz.a02.azurefd.net/contact + * Method: `GET` + * Parameter: `` + * Attack: `` + * Evidence: `from` + * Other Info: `The following pattern was used: \bFROM\b and was detected in the element starting with: "