endpointlabs / VulnerableDotNetCore3Project

.Net Core 3.0
0 stars 0 forks source link

TLS/SSL Server is enabling the BEAST attack #109

Open zisanyavuz opened 6 days ago

zisanyavuz commented 6 days ago

A high severity infra vulnerability has been discovered.

Infra Group: test2,test79 - test

Scanner Name: rapid7infra

Target: 172.67.159.157 : 443

CVE: CVE-2011-3389

Service: HTTPS

Exploitable: true

Protocol: tcp


Proof: Negotiated with the following insecure cipher suites: TLS 1.0 ciphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHATLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA

Tool Description: The SSL protocol, as used in certain configurations of Microsoft Windows and browsers such as Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera (and other products negotiating SSL connections) encrypts data by using CBC mode with chained initialization vectors. This potentially allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack. By supporting the affected protocols and ciphers, the server is enabling the clients in to being exploited.. CVSS2 score: 4.300000 Service Name: Port: Protocol: Proof: Service Name: HTTPS Port: 443 Protocol: tcp Proof: Negotiated with the following insecure cipher suites: TLS 1.0 ciphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHATLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA

Kondukto Link: https://9a4f-104-155-30-65.ngrok-free.app/projects/6703db4e0fadccdc7e5dfc4c/vulns/infra?page=1&perPage=15&id=in:672b2208b6c9a7516937c081 Deeplink: https://10.20.104.26:3780//vulnerability/vuln-summary.jsp?vulnid=ssl-cve-2011-3389-beast