Spike - Investigate/resolve Webinspect medium findings for April 2024

[ADPennington]

Description:

There are 3 medium findings in the April 2024 Webinspect scan located here :lock: one is related to the session cookie and has already been addressed. the other 2 needs review and potential remediation. If false positive, please document in raft's OneNote page linked above.

Acceptance Criteria: Create a list of functional outcomes that must be achieved to complete this issue

• [ ] 2nd medium finding reviewed and/or resolved
• [ ] 3rd medium finding reviewed and/or resolved
• [ ] Testing Checklist has been run and all tests pass
• [ ] README is updated, if necessary

Tasks: Create a list of granular, specific work items that must be completed to deliver the desired outcomes of this issue

• [ ] Task 1
• [ ] Task 2
• [ ] Task 3
• [ ] Run Testing Checklist and confirm all tests pass

Notes: Add additional useful information, such as related issues and functionality that isn't covered by this specific issue, and other considerations that will be helpful for anyone reading this

• Note 1
• Note 2
• Note 3

Supporting Documentation: Please include any relevant log snippets/files/screen shots

• Doc 1
• Doc 2

Open Questions: Please include any questions or decisions that must be made before beginning work or to confidently call this issue complete

• Open Question 1
• Open Question 2

[ADPennington]

5/10/2024 update on checking if medium findings are reproducible:

1. Insecure Deployment: OpenSSL

   • webinspect recommendation was to check the openssl version on the server. OpenSSL 0.9.8 SSL/TLS users should upgrade to 0.9.8za or later. OpenSSL 1.0.0 SSL/TLS users should upgrade to 1.0.0m or later. OpenSSL 1.0.1 SSL/TLS users should upgrade to 1.0.1h or later
   • result after checking version on backend: OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022) The issue appears to be a false positive.

2. Insecure Transport: SSLv3/TLS Renegotiation Stream Injection

   • webinspect recommendation is to use openssl to test connection renegotiation. the presumption is that if it fails, the server is vulnerable.
   • result: The server employs TLS 1.3, which does not support the renegotiation feature available in older TLS versions reference. Manual testing with openssl verified that the server correctly rejects renegotiation attempts, consistent with TLS 1.3 standards. The issue appears to be a false positive.