search

MISP / misp-docker

A production ready Dockered MISP
GNU General Public License v3.0
153 stars 92 forks source link

HSTS Missing From HTTPS Server (RFC 6797) #166

Closed Tux-Panik closed 18 hours ago

Tux-Panik commented 18 hours ago

According to a vulnerability scan I ran on the application, while it was exposed without any filtering, the scan engine raised the following CVSS 5.8 weakness: HSTS Missing From HTTPS Server (RFC 6797)

Issue: The remote web server is not enforcing HSTS, as defined by RFC 6797. HSTS is an optional response header that can be configured on the server to instruct the browser to only communicate via HTTPS. The lack of HSTS allows downgrade attacks, SSL-stripping man-in-the-middle attacks, and weakens cookie-hijacking protections. https://tools.ietf.org/html/rfc6797

Solution : Configure the remote web server to use HSTS.

I found the following documentation, but so far the few tests I did were not concluant: https://www.ephost.com/account/index.php/knowledgebase/221/How-to-enable-HSTS-and-Security-Response-Headers.html

Any idea to avoid this issue? Regards,

ostefano commented 18 hours ago

Try setting the HSTS_MAX_AGE= variable.

Tux-Panik commented 18 hours ago

Thanks @ostefano, Is it a new/recent setting?

ostefano commented 18 hours ago

Correct

Tux-Panik commented 18 hours ago

Good to know. Thus, I'll upgrade to latest image first and then will enable the setting. Thanks a lot!