Chi tiết CWE-1428

The product provides or relies on use of HTTP communications when HTTPS is available.

Các cách xuất hiện

Architecture and Design : The product might be designed in a way that assumes that HTTP will be used, e.g., by excluding considerations of encrypted communications between client and server.
Requirements : Product requirements might not include encrypted communications, which could make it easier for designers and developers to choose HTTP.
Implementation : Developers might choose to use unencrypted protocols such as HTTP because they would not require development of additional mechanisms to support encryption, e.g., key or certificate management.
Implementation : When generating content that references web sites such as email messages, ensure that the https:// prefix is included. If a domain name is presented without such a prefix, then clients might automatically treat the link as if it had an "http" prefix. For example, referencing a domain like "mysite.example.com" could cause it to be treated like "http://mysite.example.com", thereby sending unencrypted HTTP requests.
Operation : Designers might assume that the responsibility for encrypted communications might belong to operators and/or network administrators.

Nền tảng áp dụng

Ngôn ngữ

Lớp: Not Language-Specific (Undetermined)

Hệ điều hành

Lớp: Not OS-Specific (Undetermined)

Kiến trúc

Lớp: Not Architecture-Specific (Undetermined)

Công nghệ

Lớp: Not Technology-Specific (Undetermined)

Hậu quả phổ biến

Các biện pháp giảm thiểu tiềm năng

Phases : Architecture and Design
Unlike many other protocols, HTTPS is widely available as a more secure alternative, because it uses encryption. Explicitly require HTTPS or another mechanism that ensures that communication is encrypted [REF-1464].
Phases : Implementation
Avoid using "mixed content," i.e., serving a web page over HTTPS in which the page includes elements that use "http:" URLs [REF-1466] [REF-1467]. This is often done for images or other resources that do not seem to have privacy or security implications.
Phases : Implementation // Operation
Perform "HTTPS forcing," that is, redirecting HTTP requests to HTTPS.
Phases : Operation
If the product supports multiple protocols, ensure that encrypted protocols (such as HTTPS) are required, and remove any unencrypted protocols (such as HTTP).

Ghi chú ánh xạ lỗ hổng

Lý do : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Bình luận : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Tài liệu tham khảo

REF-1461

What's the Difference Between HTTP and HTTPS?
Amazon.
https://aws.amazon.com/compare/the-difference-between-https-and-http/

REF-1462

Why is HTTP not secure? | HTTP vs. HTTPS
Cloudflare.
https://www.cloudflare.com/learning/ssl/why-is-http-not-secure/

REF-1463

Every Pipe, Every Byte: The Case for Universal Encryption
Bob Lord.
https://medium.com/@boblord/every-pipe-every-byte-the-case-for-universal-encryption-b8e08939d2b9

REF-1464

Encrypting the Web
Electronic Frontier Foundation.
https://www.eff.org/encrypt-the-web/

REF-1465

Application Security Verification Standard 4.0.3 - Final
OWASP.
https://github.com/OWASP/ASVS/blob/v4.0.3/4.0/OWASP%20Application%20Security%20Verification%20Standard%204.0.3-en.pdf

REF-1465

Application Security Verification Standard 4.0.3 - Final
OWASP.
https://github.com/OWASP/ASVS/blob/v4.0.3/4.0/OWASP%20Application%20Security%20Verification%20Standard%204.0.3-en.pdf

REF-1465

Application Security Verification Standard 4.0.3 - Final
OWASP.
https://github.com/OWASP/ASVS/blob/v4.0.3/4.0/OWASP%20Application%20Security%20Verification%20Standard%204.0.3-en.pdf

REF-1466

Fixing mixed content
https://web.dev/articles/fixing-mixed-content

REF-1467

Mixed content
Mozilla.
https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content

Gửi

Sửa đổi