风险评估报告扣钱 [Web风险评估报告]

Acunetix Website Audit 10

nginx SPDY heap buffer overflow

Severity High

Type Configuration

Reported by module Scripting (Version_Check.script)

Description

A heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request. The problem affects nginx compiled with the ngx_http_spdy_module module (which is not compiled by default) and without --with-debug configure option, if the "spdy" option of the "listen" directive is used in a configuration file.

Impact

An attacker can cause a heap memory buffer overflow in a worker process by using a specially crafted request, potentially resulting in arbitrary code execution

Recommendation

Upgrade nginx to the latest version of apply the patch provided by the vendor.

References

nginx security advisory (CVE-2014-0133)

nginx patch

CVE-2014-0133

Affected items

Web Server

Details

Current version is : nginx/1.4.1

Acunetix Website Audit 11

Vulnerable Javascript library

Severity High

Type Configuration

Reported by module Scripting (Javascript_Libraries_Audit.script)

Description

You are using a vulnerable Javascript library. One or more vulnerabilities were reported for this version of the Javascript library. Consult Attack details and Web References for more information about the affected library and the vulnerabilities that were reported.

Impact

Consult Web References for more information.

Recommendation

Upgrade to the latest version.

References

http://www.thomasfrank.se/sessionvars.html

Affected items

/static/app/libs/sessvars.js

Details

Detected Javascript library sessvars version 1.00.

The version was detected from file content.

Request headers

GET /static/app/libs/sessvars.js HTTP/1.1

Pragma: no-cache

Cache-Control: no-cache

Referer: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/

Acunetix-Aspect: enabled

Acunetix-Aspect-Password: *****

Acunetix-Aspect-Queries: filelist;aspectalerts

Host: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36

Accept: */*

Acunetix Website Audit 12

XML external entity injection

Severity High

Type Configuration

Reported by module Scripting (XML_External_Entity_Injection.script)

Description

XML supports a facility known as "external entities", which instruct an XML processor to retrieve and perform an inline include of XML located at a particular URI. An external XML entity can be used to append or modify the document type declaration (DTD) associated with an XML document. An external XML entity can also be used to include XML within the content of an XML document.

Now assume that the XML processor parses data originating from a source under attacker control. Most of the time the processor will not be validating, but it MAY include the replacement text thus initiating an unexpected file open operation, or HTTP transfer, or whatever system ids the XML processor knows how to access.

below is a sample XML document that will use this functionality to include the contents of a local file (/etc/passwd)

]>

&acunetixent;

Impact

Attacks can include disclosing local files, which may contain sensitive data such as passwords or private user data, using file: schemes or relative paths in the system identifier. Since the attack occurs relative to the application processing the XML document, an attacker may use this trusted application to pivot to other internal systems, possibly disclosing other internal content via http(s) requests.

Recommendation

If possible it"s recommended to disable parsing of XML external entities.

References

CWE-611: Information Exposure Through XML External Entity Reference

XXE (Xml eXternal Entity) attack

Affected items

/forgotpw

Details

Custom POST input text/xml was set to ]> &acunetixent;

An HTTP request was initiated for the domain hitGeSnJELhat.bxss.me which indicates that this script is vulnerable to XXE injection.

HTTP request details:

IP address: 176.28.50.165

User agent: Python-urllib/1.17

Request headers

POST /forgotpw HTTP/1.1

Content-Type: text/xml

Content-Length: 156

Host: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36

Accept: */*

Acunetix Website Audit 13

]>

&acunetixent;

Acunetix Website Audit 14

HTML form without CSRF protection

Severity Medium

Type Informational

Reported by module Crawler

Description

This alert may be a false positive, manual confirmation is required.

Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF or XSRF, is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts. Acunetix WVS found a HTML form with no apparent CSRF protection implemented. Consult details for more information about the affected HTML form.

Impact

An attacker may force the users of a web application to execute actions of the attacker""s choosing. A successful CSRF exploit can compromise end user data and operation in case of normal user. If the targeted end user is the administrator account, this can compromise the entire web application.

Recommendation

Check if this form requires CSRF protection and implement CSRF countermeasures if necessary.

Affected items

/

Details

Form name:

Form action: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/login

Form method: POST

Form inputs:

- username [Text]

- password [Password]

Request headers

GET / HTTP/1.1

Pragma: no-cache

Cache-Control: no-cache

Acunetix-Aspect: enabled

Acunetix-Aspect-Password: *****

Acunetix-Aspect-Queries: filelist;aspectalerts

Host: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36

Accept: */*

Acunetix Website Audit 15

User credentials are sent in clear text

Severity Medium

Type Configuration

Reported by module Crawler

Description

User credentials are transmitted over an unencrypted channel. This information should always be transferred via an encrypted channel (HTTPS) to avoid being intercepted by malicious users.

Impact

A third party may be able to read the user credentials by intercepting an unencrypted HTTP connection. Recommendation

Because user credentials are considered sensitive information, should always be transferred to the server over an encrypted connection (HTTPS).

Affected items

/

Details

Form name:

Form action: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/login

Form method: POST

Form inputs:

- username [Text]

- password [Password]

Request headers

GET / HTTP/1.1

Pragma: no-cache

Cache-Control: no-cache

Acunetix-Aspect: enabled

Acunetix-Aspect-Password: *****

Acunetix-Aspect-Queries: filelist;aspectalerts

Host: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36

Accept: */*

Acunetix Website Audit 16

Clickjacking: X-Frame-Options header missing

Severity Low

Type Configuration

Reported by module Scripting (Clickjacking_X_Frame_Options.script)

Description

Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on, thus potentially revealing confidential information or taking control of their computer while clicking on seemingly innocuous web pages.

The server didn"t return an X-Frame-Options header which means that this website could be at risk of a clickjacking attack. The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame> or <iframe>. Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites.

Impact

The impact depends on the affected web application.

Recommendation

Configure your web server to include an X-Frame-Options header. Consult Web references for more information about the possible values for this header.

References

Clickjacking

Original Clickjacking paper

The X-Frame-Options response header

Affected items

Web Server

Details

No details are available.

Request headers

GET / HTTP/1.1

Cookie: username=admin

Host: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36

Accept: */*

Acunetix Website Audit 17

Login page password-guessing attack

Severity Low

Type Validation

Reported by module Scripting (Html_Authentication_Audit.script)

Description

A common threat web developers face is a password-guessing attack known as a brute force attack. A brute-force attack is an attempt to discover a password by systematically trying every possible combination of letters, numbers, and symbols until you discover the one correct combination that works.

This login page doesn"t have any protection against password-guessing attacks (brute force attacks). It"s recommended to implement some type of account lockout after a defined number of incorrect password attempts. Consult Web references for more information about fixing this problem.

Impact

An attacker may attempt to discover a weak password by systematically trying every possible combination of letters, numbers, and symbols until it discovers the one correct combination that works.

Recommendation

It"s recommended to implement some type of account lockout after a defined number of incorrect password attempts. References

Blocking Brute Force Attacks

Affected items

/login

Details

The scanner tested 10 invalid credentials and no account lockout was detected.

Request headers

POST /login HTTP/1.1

Content-Length: 35

Content-Type: application/x-www-form-urlencoded

Referer: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html:80/

Host: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36

Accept: */*

password=o0hSGecC&username=yt3cHv3b

Acunetix Website Audit 18

OPTIONS method is enabled

Severity Low

Type Validation

Reported by module Scripting (Options_Server_Method.script)

Description

HTTP OPTIONS method is enabled on this web server. The OPTIONS method provides a list of the methods that are supported by the web server, it represents a request for information about the communication options available on the request/response chain identified by the Request-URI.

Impact

The OPTIONS method may expose sensitive information that may help an malicious user to prepare more advanced attacks.

Recommendation

It"s recommended to disable OPTIONS Method on the web server.

References

Testing for HTTP Methods and XST (OWASP-CM-008)

Affected items

Web Server

Details

Methods allowed: HEAD, OPTIONS, GET

Request headers

OPTIONS / HTTP/1.1

Host: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36

Accept: */*

Acunetix Website Audit 19

Possible sensitive directories

Severity Low

Type Validation

Reported by module Scripting (Possible_Sensitive_Directories.script)

Description

A possible sensitive directory has been found. This directory is not directly linked from the website.This check looks for common sensitive resources like backup directories, database dumps, administration pages, temporary directories. Each one of these directories could help an attacker to learn more about his target.

Impact

This directory may expose sensitive information that could help a malicious user to prepare more advanced attacks. Recommendation

Restrict access to this directory or remove it from the website.

References

Web Server Security and Database Server Security

Affected items

/admin

Details

No details are available.

Request headers

GET /admin HTTP/1.1

Accept: acunetix/wvs

Range: bytes=0-99999

Host: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36

Acunetix Website Audit 20

Possible virtual host found

Severity Low

Type Configuration

Reported by module Scripting (VirtualHost_Audit.script)

Description

Virtual hosting is a method for hosting multiple domain names (with separate handling of each name) on a single server (or pool of servers). This allows one server to share its resources, such as memory and processor cycles, without requiring all services provided to use the same host name.

This web server is responding differently when the Host header is manipulated and various common virtual hosts are tested. This could indicate there is a Virtual Host present.

Impact

Possible sensitive information disclosure.

Recommendation

Consult the virtual host configuration and check if this virtual host should be publicly accessible.

References

Virtual hosting

Affected items

localhost

Details

VirtualHost: localhost

Response:

Request headers

GET / HTTP/1.0

Host: localhost

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Acunetix Website Audit 21

Session Cookie without HttpOnly flag set

Severity Low

Type Informational

Reported by module Crawler

Description

This cookie does not have the HTTPOnly flag set. When a cookie is set with the HTTPOnly flag, it instructs the browser that the cookie can only be accessed by the server and not by client-side scripts. This is an important security protection for session cookies.

Impact

None

Recommendation

If possible, you should set the HTTPOnly flag for this cookie.

Affected items

/

Details

Cookie name: "username"

Cookie domain: "http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html"

Request headers

GET / HTTP/1.1

Cookie: username=admin

Host: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36

Accept: */*

Acunetix Website Audit 22

Session Cookie without Secure flag set

Severity Low

Type Informational

Reported by module Crawler

Description

This cookie does not have the Secure flag set. When a cookie is set with the Secure flag, it instructs the browser that the cookie can only be accessed over secure SSL channels. This is an important security protection for session cookies. Impact

None

Recommendation

If possible, you should set the Secure flag for this cookie.

Affected items

/

Details

Cookie name: "username"

Cookie domain: "http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html"

Request headers

GET / HTTP/1.1

Cookie: username=admin

Host: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36

Accept: */*

Acunetix Website Audit 23

Password type input with auto-complete enabled

Severity Informational

Type Informational

Reported by module Crawler

Description

When a new name and password is entered in a form and the form is submitted, the browser asks if the password should be saved.Thereafter when the form is displayed, the name and password are filled in automatically or are completed as the name is entered. An attacker with local access could obtain the cleartext password from the browser cache.

Impact

Possible sensitive information disclosure.

Recommendation

The password auto-complete should be disabled in sensitive applications.

To disable auto-complete, you may use a code similar to:

Affected items

/

Details

Password type input named password from form with ID loginForm with action /login has autocomplete enabled.

Request headers

GET / HTTP/1.1

Pragma: no-cache

Cache-Control: no-cache

Acunetix-Aspect: enabled

Acunetix-Aspect-Password: *****

Acunetix-Aspect-Queries: filelist;aspectalerts

Host: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36

Accept: */*

Acunetix Website Audit 24

Scanned items (coverage report)

Scanned 18 URLs. Found 4 vulnerable.

URL: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/

Vulnerabilities has been identified for this URL

2 input(s) found for this URL

Inputs

Input scheme 1

Input name Input type

/ Path Fragment

Input scheme 2

Input name Input type

Host HTTP Header

URL: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/login

Vulnerabilities has been identified for this URL

2 input(s) found for this URL

Inputs

Input scheme 1

Input name Input type password URL encoded POST username URL encoded POST

URL: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/static

No vulnerabilities has been identified for this URL

No input(s) found for this URL

URL: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/static/css/

No vulnerabilities has been identified for this URL

No input(s) found for this URL

URL: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/static/css/style.css

No vulnerabilities has been identified for this URL

No input(s) found for this URL

URL: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/static/img/

No vulnerabilities has been identified for this URL

No input(s) found for this URL

URL: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/static/app/

No vulnerabilities has been identified for this URL

No input(s) found for this URL

URL: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/static/app/app.js

No vulnerabilities has been identified for this URL

No input(s) found for this URL

URL: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/static/app/libs/

No vulnerabilities has been identified for this URL

No input(s) found for this URL

URL: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/static/app/libs/sessvars.js

Vulnerabilities has been identified for this URL

No input(s) found for this URL

URL: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/static/app/post.js

No vulnerabilities has been identified for this URL

No input(s) found for this URL

Acunetix Website Audit 25

URL: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/static/app/controllers/

No vulnerabilities has been identified for this URL

No input(s) found for this URL

URL: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/static/app/controllers/controllers.js

No vulnerabilities has been identified for this URL

No input(s) found for this URL

URL: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/static/app/services/

No vulnerabilities has been identified for this URL

No input(s) found for this URL

URL: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/static/app/services/itemsService.js

No vulnerabilities has been identified for this URL

No input(s) found for this URL

URL: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/logout

No vulnerabilities has been identified for this URL

No input(s) found for this URL

URL: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/forgotpw

Vulnerabilities has been identified for this URL

2 input(s) found for this URL

Inputs

Input scheme 1

Input name Input type

text/xml Custom POST http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.htmlername#text XML

URL: http://www.wendangku.net/doc/3b1d9df17d1cfad6195f312b3169a4517723e5ad.html/admin/

No vulnerabilities has been identified for this URL

No input(s) found for this URL

Acunetix Website Audit

推荐访问:咨询保密风险评估报告 评估报告 风险 Web