CWE-1428 상세 정보

The product provides or relies on use of HTTP communications when HTTPS is available.

취약점 도입 방식

Architecture and Design : The product might be designed in a way that assumes that HTTP will be used, e.g., by excluding considerations of encrypted communications between client and server.
Requirements : Product requirements might not include encrypted communications, which could make it easier for designers and developers to choose HTTP.
Implementation : Developers might choose to use unencrypted protocols such as HTTP because they would not require development of additional mechanisms to support encryption, e.g., key or certificate management.
Implementation : When generating content that references web sites such as email messages, ensure that the https:// prefix is included. If a domain name is presented without such a prefix, then clients might automatically treat the link as if it had an "http" prefix. For example, referencing a domain like "mysite.example.com" could cause it to be treated like "http://mysite.example.com", thereby sending unencrypted HTTP requests.
Operation : Designers might assume that the responsibility for encrypted communications might belong to operators and/or network administrators.

적용 가능한 플랫폼

언어

클래스: Not Language-Specific (Undetermined)

운영 체제

클래스: Not OS-Specific (Undetermined)

아키텍처

클래스: Not Architecture-Specific (Undetermined)

기술

클래스: Not Technology-Specific (Undetermined)

일반적인 결과

잠재적 완화 방법

Phases : Architecture and Design
Unlike many other protocols, HTTPS is widely available as a more secure alternative, because it uses encryption. Explicitly require HTTPS or another mechanism that ensures that communication is encrypted [REF-1464].
Phases : Implementation
Avoid using "mixed content," i.e., serving a web page over HTTPS in which the page includes elements that use "http:" URLs [REF-1466] [REF-1467]. This is often done for images or other resources that do not seem to have privacy or security implications.
Phases : Implementation // Operation
Perform "HTTPS forcing," that is, redirecting HTTP requests to HTTPS.
Phases : Operation
If the product supports multiple protocols, ensure that encrypted protocols (such as HTTPS) are required, and remove any unencrypted protocols (such as HTTP).

취약점 매핑 메모

근거 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
댓글 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

참고 자료

REF-1461

What's the Difference Between HTTP and HTTPS?
Amazon.
https://aws.amazon.com/compare/the-difference-between-https-and-http/

REF-1462

Why is HTTP not secure? | HTTP vs. HTTPS
Cloudflare.
https://www.cloudflare.com/learning/ssl/why-is-http-not-secure/

REF-1463

Every Pipe, Every Byte: The Case for Universal Encryption
Bob Lord.
https://medium.com/@boblord/every-pipe-every-byte-the-case-for-universal-encryption-b8e08939d2b9

REF-1464

Encrypting the Web
Electronic Frontier Foundation.
https://www.eff.org/encrypt-the-web/

REF-1465

Application Security Verification Standard 4.0.3 - Final
OWASP.
https://github.com/OWASP/ASVS/blob/v4.0.3/4.0/OWASP%20Application%20Security%20Verification%20Standard%204.0.3-en.pdf

REF-1465

Application Security Verification Standard 4.0.3 - Final
OWASP.
https://github.com/OWASP/ASVS/blob/v4.0.3/4.0/OWASP%20Application%20Security%20Verification%20Standard%204.0.3-en.pdf

REF-1465

Application Security Verification Standard 4.0.3 - Final
OWASP.
https://github.com/OWASP/ASVS/blob/v4.0.3/4.0/OWASP%20Application%20Security%20Verification%20Standard%204.0.3-en.pdf

REF-1466

Fixing mixed content
https://web.dev/articles/fixing-mixed-content

REF-1467

Mixed content
Mozilla.
https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content

제출

수정 사항