Skip to main content

Insecure Configuration

This vulnerability category covers the following issues:

About Cookie Flags

HTTP cookies are small pieces of data that are sent from a website to a user's web browser and stored on the user's device. Cookies can be used for a variety of purposes, such as tracking user sessions, remembering user preferences, and serving targeted ads.

However, if cookies are not configured correctly, they can be vulnerable to attacks that can compromise the security of a website and the privacy of its users. One common vulnerability is the use of insecure cookie flags. Insecure cookie flags are settings that can be configured for a cookie to specify how the cookie should be transmitted and stored.

Some common insecure cookie flags include:

  • "Secure" flag: This flag indicates that the cookie should only be transmitted over HTTPS connections. If the cookie is transmitted over an insecure HTTP connection, it can be intercepted by an attacker and used to impersonate the user.
  • "HttpOnly" flag: This flag indicates that the cookie should not be accessible by client-side scripts, such as JavaScript. If the cookie is accessible to client-side scripts, it can be vulnerable to cross-site scripting (XSS) attacks.
  • "SameSite" flag: This flag indicates that the cookie should only be sent in requests that originate from the same site as the one that set the cookie. If the cookie is sent in requests from other sites, it can be vulnerable to cross-site request forgery (CSRF) attacks.

Check out this video for a high-level explanation:

Some of the potential consequences of using insecure cookie flags are:

  • Session hijacking: If cookies are not configured with the "Secure" flag, they can be intercepted by an attacker and used to hijack a user's session. An attacker can use the stolen cookie to impersonate the user and access sensitive information or perform unauthorized actions on the website.
  • Cross-site scripting (XSS) attacks: If cookies are not configured with the "HttpOnly" flag, they can be accessed by client-side scripts, such as JavaScript. This makes the cookie vulnerable to XSS attacks, where an attacker can inject malicious code into a website and steal the cookie.
  • Cross-site request forgery (CSRF) attacks: If cookies are not configured with the "SameSite" flag, they can be sent in requests from other sites. This makes the cookie vulnerable to CSRF attacks, where an attacker can trick a user into unknowingly performing an action on the website that the user did not intend to perform.
  • Data breaches: If cookies contain sensitive information, such as login credentials or personal data, they can be exposed in a data breach. If the cookie is not configured with the "Secure" flag, the data can be intercepted by an attacker and used for malicious purposes.

The best practices to follow for secure cookie flags are:

  • Set the "Secure" flag: This flag ensures that cookies are only transmitted over HTTPS connections. This prevents cookies from being intercepted by attackers and helps prevent session hijacking attacks. Ensure that all cookies that contain sensitive information or are used for session management are configured with the "Secure" flag.
  • Set the "HttpOnly" flag: This flag ensures that cookies are not accessible by client-side scripts, such as JavaScript. This prevents cookies from being vulnerable to cross-site scripting (XSS) attacks. Ensure that all cookies that contain sensitive information are configured with the "HttpOnly" flag.
  • Set the "SameSite" flag: This flag ensures that cookies are only sent in requests that originate from the same site as the one that set the cookie. This prevents cookies from being vulnerable to cross-site request forgery (CSRF) attacks. Ensure that all cookies that are used for session management or perform actions on behalf of the user are configured with the "SameSite" flag.
  • Use a secure cookie storage mechanism: Ensure that cookies are stored securely on the user's device and are not accessible to other applications or users. Use a secure cookie storage mechanism, such as HttpOnly cookies, to prevent cookies from being accessed or modified by attackers. Regularly review and update cookie settings: Regularly review and update cookie settings to ensure that they are up-to-date with the latest best practices and security recommendations. Ensure that all cookies are configured with the appropriate secure flags and that any cookies that are no longer needed are deleted.

References​

Taxonomies​

Explanation & Prevention​

Training​

  1. Go through the issues that GuardRails identified in the PR/MR

  2. Locate the pattern that either sets the secure or httpOnly flags to false, or doesn't set the values at all

  3. And modify it to set both flags, for example in Express:

    app.use(session({
      cookie: {
        secure: true,
        httpOnly: true
      }
    }))

  4. Test it, ship it 🚢 and relax 🌴

Fixing Security Headers​

About HTTP Security Headers

What are insecure HTTP security headers?​

HTTP security headers are a set of headers that can be sent by a web server to a user's web browser to help protect against various types of attacks, such as cross-site scripting (XSS), clickjacking, and cross-site request forgery (CSRF).

These headers provide additional security controls that can help to prevent attackers from exploiting vulnerabilities in web applications.

However, if these security headers are not configured correctly, they can be vulnerable to attacks that compromise the security of a website and its users. One common vulnerability is the use of insecure HTTP security headers. Insecure HTTP security headers are settings that can be configured for a security header to specify how the header should be transmitted and stored.

Some common insecure HTTP security headers include:

  • "X-Frame-Options" header: This header is used to prevent clickjacking attacks by indicating whether a page can be displayed in an iframe. If the header is not set or is set incorrectly, a page can be vulnerable to clickjacking attacks.
  • "Content-Security-Policy" header: This header is used to prevent XSS attacks by specifying which sources of content are allowed to be loaded by a web page. If the header is not set or is set incorrectly, a page can be vulnerable to XSS attacks.
  • "X-XSS-Protection" header: This header is used to enable the browser's built-in XSS protection mechanisms. If the header is not set or is set incorrectly, a website can be vulnerable to XSS attacks.
  • "Strict-Transport-Security" header: This header is used to ensure that a website is only accessed over HTTPS connections. If the header is not set or is set incorrectly, a website can be vulnerable to man-in-the-middle attacks.
  • "Cross-Origin Resource Sharing (CORS)" headers: This header is used to protect against cross-site request forgery (CSRF) and other types of attacks. It specifies which origins, HTTP methods, and credentials are allowed to be accessed.

Check out this video for a high-level explanation:

What is the impact of insecure HTTP security headers?​

Some of the potential consequences of using insecure HTTP security headers are:

  • Increased risk of cross-site scripting (XSS) attacks: If the "Content-Security-Policy", or "X-XSS-Protection" header is not set or is set incorrectly, a website can be vulnerable to XSS attacks. This can allow attackers to inject malicious code into a website and steal sensitive information, such as login credentials or personal data.
  • Increased risk of clickjacking attacks: If the "X-Frame-Options" header is not set or is set incorrectly, a website can be vulnerable to clickjacking attacks. This can allow attackers to trick users into performing actions that they did not intend to perform, such as clicking on a button that executes a malicious action.
  • Increased risk of cross-site request forgery (CSRF) attacks: If the "Access-Control-Allow-Origin" header is not set or is set incorrectly, a website can be vulnerable to CSRF attacks. This can allow attackers to trick users into unknowingly performing actions on the website that they did not intend to perform.
  • Increased risk of data breaches: If HTTP security headers are not configured correctly, a website can be vulnerable to data breaches. This can allow attackers to steal sensitive information, such as login credentials or personal data, and use it for malicious purposes.

How to prevent insecure HTTP security headers?​

Some of the best practices to prevent insecure HTTP security headers are:

  • Set the appropriate values for HTTP security headers: Each HTTP security header has a set of valid values that can be used to configure it. Ensure that the appropriate values are set for each header to provide the desired level of protection against attacks.
  • Regularly review and update HTTP security header settings: Regularly review and update HTTP security header settings to ensure that they are up-to-date with the latest best practices and security recommendations.
  • Use tools to validate HTTP security header settings: Use tools, such as the Mozilla Observatory, to validate the configuration of HTTP security headers and ensure that they are set correctly. These tools can also provide recommendations for improving the security of a website.
  • Use a content delivery network (CDN) with built-in security features: Some CDNs offer built-in security features, such as the automatic configuration of HTTP security headers. Consider using a CDN with these features to simplify the configuration and management of HTTP security headers.

References​

Taxonomies​

Explanation & Prevention​

Training​

Option A: Ensure Helmet is configured correctly​

  1. Go through the issues that GuardRails identified in the PR/MR

  2. Locate the endpoint with the following pattern:

    app.use(
      helmet({
        hsts:: false,
      })
    );

  3. And ensure that they are enabled, unless there is a very good reason to do so

  4. Test it by checking your URL at SecurityHeaders.io

  5. Ship it 🚢 and relax 🌴

Option B: Ensure XSS Security Headers are enabled​

  1. Go through the issues that GuardRails identified in the PR/MR

  2. Identify the code with one of these patterns:

    // XSS Security Headers
    lusca.xssProtection(false);
    X-XSS-Protection = 0;

  3. And ensure the headers are enabled. Note: It may be possible that this is handled on the loadbalancers or webservers

  4. Test it, ship it 🚢 and relax 🌴

Option C: Set a proper Cross-Origin Resource Sharing (CORS) policy​

  1. Go through the issues that GuardRails identified in the PR/MR
  2. Remove the code that sets the Access-Control-Allow-Origin header with a *
  3. And add your domain name instead of the *
  4. Test it
  5. Ship it 🚢 and relax 🌴

Fixing Insecure Configuration​

About Insecure Configuration

What is Insecure Configuration?​

Insecure configuration refers to the situation where a system or application is configured with settings or parameters that do not adequately protect it against security threats.

Examples of insecure configurations include using default or weak passwords, allowing open access to network ports, enabling unnecessary services or protocols, and misconfiguring access controls.

Insecure configuration can occur at any layer of the technology stack, including hardware, operating systems, applications, and network devices.

It is a common cause of security incidents and is often exploited by attackers who take advantage of misconfigured systems to gain access to sensitive information or carry out attacks.

Check out this video for a high-level explanation:

What is the impact of Insecure Configuration?​

The impact of insecure configuration can lead to financial and reputational losses and potential harm to individuals or organizations.

Insecure configurations can leave systems and applications vulnerable to a variety of security threats, including unauthorized access, data breaches, and denial of service. Attackers can exploit insecure configurations to gain access to sensitive information, steal data, install malware or ransomware, or disrupt services.

In addition to the direct financial and operational costs of such attacks, insecure configurations can also result in lost business, damage to brand reputation, and legal or regulatory penalties.

Insecure configurations can also make it difficult for organizations to comply with security and privacy regulations, such as GDPR, HIPAA, and PCI DSS. Non-compliance with these regulations can result in significant fines, legal actions, and reputational damage.

How to prevent Insecure Configuration?​

To prevent insecure configuration, it is important to follow security best practices and guidelines, such as those provided by industry standards like NIST or CIS, and to regularly review and update configurations to ensure they are up-to-date and properly secured.

Here are some specific steps you can take to prevent insecure configuration:

  • Use secure defaults: Always change the default configuration settings of software and hardware devices to more secure settings, such as changing default passwords and disabling unnecessary services.
  • Limit access: Implement the principle of least privilege and limit access to systems and applications only to authorized users who need it to perform their job duties.
  • Apply security updates: Keep systems and applications up-to-date with the latest security patches and updates to protect against known vulnerabilities.
  • Use security tools: Deploy security tools, such as vulnerability scanners and security information and event management (SIEM) systems, to monitor and manage system configurations.
  • Enforce strong passwords: Require the use of strong passwords and two-factor authentication for accessing systems and applications.
  • Follow security standards and frameworks: Implement security standards and frameworks, such as NIST or CIS, to ensure that your configurations adhere to industry best practices.
  • Regularly review and audit configurations: Regularly review and audit system configurations to ensure they are properly secured and to identify and address any vulnerabilities or misconfigurations.

By taking these steps, you can significantly reduce the risk of insecure configuration and protect your systems and applications from security threats.

References​

Taxonomies​

Training​

Option A: Enable Electron webSecurity​

Disabling webSecurity will disable the same-origin policy and allows the execution of insecure code from any domain.

  1. Go through the issues that GuardRails identified in the PR/MR

  2. Locate the following pattern:

    const { app, BrowserWindow } = require('electron')

    function createWindow() {
      // Create a new BrowserWindow
      const mainWindow = new BrowserWindow({
        width: 800,
        height: 600,
        webPreferences: {
          webSecurity: true // Disabled web security
        }
      })

      // ...
    }

  3. And set webSecurity to true

  4. Test it, ship it 🚢 and relax 🌴

Option B: Disable Electron nodeIntegration​

An electron app that has Node integration enabled and is vulnerable to Cross-Site Scripting, can be abused to execute code remotely vulnerabilities on the application.

  1. Go through the issues that GuardRails identified in the PR/MR

  2. Locate the following pattern:

    const { app, BrowserWindow } = require('electron')

    function createWindow() {
      // Create a new BrowserWindow
      const mainWindow = new BrowserWindow({
        width: 800,
        height: 600,
        webPreferences: {
          nodeIntegration: true,
          nodeIntegrationInWorker: true
        }
      })

      // ...
    }

  3. And set nodeIntegration to false

  4. Test it, ship it 🚢 and relax 🌴

Last updated on by Stefan Streichsbier