ZAP report

[github-actions[bot]]

• Site: http://127.0.0.1:8000 New Alerts
  • Web Cache Deception [40039] total: 1:
    • http://127.0.0.1:8000/web
  • Deprecated Feature Policy Header Set [10063] total: 11:
    • http://127.0.0.1:8000/static/commons.html
    • http://127.0.0.1:8000/static/error_pages.html
    • http://127.0.0.1:8000/static/Errors.html
    • http://127.0.0.1:8000/static/index.html
    • http://127.0.0.1:8000/static/manage_defaults_databases.html
    • ..
  • Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 10:
    • http://127.0.0.1:8000
    • http://127.0.0.1:8000/
    • http://127.0.0.1:8000/robots.txt
    • http://127.0.0.1:8000/sitemap.xml
    • http://127.0.0.1:8000/static/Errors.html
    • ..
  • Base64 Disclosure [10094] total: 12:
    • http://127.0.0.1:8000/static/
    • http://127.0.0.1:8000/static/init.py
    • http://127.0.0.1:8000/static/builtins.html
    • http://127.0.0.1:8000/static/commons.py
    • http://127.0.0.1:8000/static/ntpath.html
    • ..
  • CSP: Header & Meta [10055] total: 11:
    • http://127.0.0.1:8000/static/
    • http://127.0.0.1:8000/static/init.py
    • http://127.0.0.1:8000/static/builtins.html
    • http://127.0.0.1:8000/static/commons.py
    • http://127.0.0.1:8000/static/ntpath.html
    • ..
  • Information Disclosure - Suspicious Comments [10027] total: 11:
    • http://127.0.0.1:8000/js/webscripts_index_js_scripts.js
    • http://127.0.0.1:8000/js/webscripts_js_scripts.js
    • http://127.0.0.1:8000/js/webscripts_js_scripts.js
    • http://127.0.0.1:8000/js/webscripts_js_scripts.js
    • http://127.0.0.1:8000/static/
    • ..
  • Modern Web Application [10109] total: 11:
    • http://127.0.0.1:8000/static/commons.html
    • http://127.0.0.1:8000/static/error_pages.html
    • http://127.0.0.1:8000/static/Errors.html
    • http://127.0.0.1:8000/static/index.html
    • http://127.0.0.1:8000/static/manage_defaults_databases.html
    • ..
  • Non-Storable Content [10049] total: 10:
    • http://127.0.0.1:8000
    • http://127.0.0.1:8000/
    • http://127.0.0.1:8000/robots.txt
    • http://127.0.0.1:8000/sitemap.xml
    • http://127.0.0.1:8000/static/Errors.html
    • ..
  • Sec-Fetch-Dest Header is Missing [90005] total: 2:
    • http://127.0.0.1:8000/
    • http://127.0.0.1:8000/web/
  • Sec-Fetch-Mode Header is Missing [90005] total: 2:
    • http://127.0.0.1:8000/
    • http://127.0.0.1:8000/web/
  • Sec-Fetch-Site Header is Missing [90005] total: 2:
    • http://127.0.0.1:8000/
    • http://127.0.0.1:8000/web/
  • Sec-Fetch-User Header is Missing [90005] total: 2:
    • http://127.0.0.1:8000/
    • http://127.0.0.1:8000/web/
  • User Agent Fuzzer [10104] total: 396:
    • http://127.0.0.1:8000
    • http://127.0.0.1:8000
    • http://127.0.0.1:8000
    • http://127.0.0.1:8000
    • http://127.0.0.1:8000
    • ..

View the following link to download the report. RunnerID:8583468408

[mauricelambert]

MEDIUM - Web Cache Deception

• False positive caused by WebScripts resolve path algorithm, the response is the same for /web, /test.css, /test.php ect... because it's the same page for WebScripts (the page is / and this page redirect to /web/).

MEDIUM - Hidden File Found

• False positive caused by WebScripts resolve path algorithm, the response code is not 404 on /BitKeeper, /.hg, /.bzr ect... because it's the root WebScripts page for WebScripts Server.

LOW - Server Leaks Version Information via "Server" HTTP Response Header Field

• This information should be overwritten by deployment (Apache and NGINX web server with WSGI and/or HTTP proxy)

LOW - Deprecated Feature Policy Header Set

• Security for old Web browser

INFORMATIONAL - CSP: Header & Meta

• Meta is added to protect server in debug mode
• Header is added to have a complete CSP (Meta doesn't support frame-ancestors directive) and non WebScripts web page (modules, CGI, ect...) doesn't have the Meta tag for CSP

INFORMATIONAL - Base64 Disclosure

• False Positive: the base64 is the CSRF Token

INFORMATIONAL - Information Disclosure - Suspicious Comments

• Comments are Copyrights, the information disclosure is the web server solution (WebScripts)

INFORMATIONAL - Modern Web Application

• ZAP explain "this is an informational alert and so no changes are required"
• Detection: noscript tag and a tag without href in pydoc documentation

INFORMATIONAL - Sec-Fetch-User Header is Missing

• Probably a False Positive, headers is set in the code and i get it in my browser

INFORMATIONAL - Sec-Fetch-Site Header is Missing

• Probably a False Positive, headers is set in the code and i get it in my browser

INFORMATIONAL - Sec-Fetch-Mode Header is Missing

• Probably a False Positive, headers is set in the code and i get it in my browser

INFORMATIONAL - Sec-Fetch-Dest Header is Missing

• Probably a False Positive, headers is set in the code and i get it in my browser

INFORMATIONAL - Non-Storable Content

• Useful to improve performance, I don't optimize this header for web hardening reasons, by default all web pages should be secure

INFORMATIONAL - User Agent Fuzzer

• There is no difference by User-Agent