Is Via G&L vulnerable to the “Strict Transport security misconfiguration”
3 years ago
Originally Published: 2016-08-30
Article Number
000059113
Article Summary
There was no "Strict-Transport-Security" header in the server response.
HTTP Strict-Transport-Security header was not found in HTTP responses.
HTTP login is already disabled at customer site.

So Is the product vulnerable to Strict-Transport-security-misconfiguration?
 
Issue Background:
The HTTP Strict Transport Security policy defines a timeframe where a browser 
must connect to the web server via HTTPS. Without a Strict Transport Security 
policy the web application may be vulnerable against several attacks: 
· If the web application mixes usage of HTTP and HTTPS, an attacker can 
manipulate pages in the unsecured area of the application or change 
redirection targets in a manner that the switch to the secured page is not 
performed or done in a manner, that the attacker remains between client and 
server. 
· If there is no HTTP server, an attacker in the same network could simulate a 
HTTP server and motivate the user to click on a prepared URL by a scoial 
engineering attack. 
The protection is effective only for the given amount of time. Multiple 
occurrence of this header could cause undefined behaviour in browsers and 
should be avoided. 

Issue Detail:
There was no "Strict-Transport-Security" header in the server response. 

Occurrences: 
GET https://sbela00350.be.extranet/aveksa/attachment?token=t6df834f71539de95ba5 
GET https://sbela00350.be.extranet/aveksa/custom.jsp?page=home.jsp 
GET https://sbela00350.be.extranet/aveksa/help/Access_Fulfillment_Express_Connector_ 
Configuration_Guide/wwhdata/common/alinks.js 
GET https://sbela00350.be.extranet/aveksa/help/Access_Fulfillment_Express_Connector_ 
Configuration_Guide/wwhdata/common/context.js 
GET https://sbela00350.be.extranet/aveksa/help/Access_Fulfillment_Express_Connector_ 
Configuration_Guide/wwhdata/common/files.js 
GET https://sbela00350.be.extranet/aveksa/help/Access_Fulfillment_Express_Connector_ 
Configuration_Guide/wwhdata/common/title.js 
GET https://sbela00350.be.extranet/aveksa/help/Access_Fulfillment_Express_Connector_ 
Configuration_Guide/wwhdata/js/toc.js 
GET https://sbela00350.be.extranet/aveksa/help/Access_Fulfillment_Express_Guide/wwhd 
ata/common/alinks.js 
GET https://sbela00350.be.extranet/aveksa/help/Access_Fulfillment_Express_Guide/wwhd 
ata/common/context.js 
GET https://sbela00350.be.extranet/aveksa/help/Access_Fulfillment_Express_Guide/wwhd 
ata/common/files.js 
GET https://sbela00350.be.extranet/aveksa/main 
… and more (global issue)

 
Resolution
This is not a significant problem, because in order to actually take advantage of it the attacker would need either root access to the box G&L is running on or else control of the DNS being used. 
And in either of those scenarios there are much worse things someone could do than the attack here. 
However, they are adding this header to help close that small window anyway, since there's no cost to them to doing so. 
It will be in upcoming releases, and may be patched back into some existing codelines at the discretion of the Customer Success team. 
It will be fixed in highland park (7.0.2) 
 
 
Disclaimer
Read and use the information in this RSA Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact RSA Software Technical Support at 1- 800 995 5095. RSA Security LLC and its affiliates, including without limitation, its ultimate parent company, EMC Corporation, distributes RSA Security Advisories in order to bring to the attention of users of the affected RSA products, important security information. RSA recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided 'as is' without warranty of any kind. RSA disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall RSA, its affiliates or suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if RSA, its affiliates or suppliers have been advised of the possibility of such damages. Some jurisdictions do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.

Related Articles

Trending Articles

Don't see what you're looking for?