Found VAPT vulnerabilities points for SSLVPN URL.
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

The Enhanced LIVEcommunity Experience is finally here! Learn all about it.

Found VAPT vulnerabilities points for SSLVPN URL.

L2 Linker

We have done the VAPT on our environment and found the vulnerabilities for the SSLVPN URL which we use.

 

We had mitigated the maximum points but five points are remaining. So need help on that.

 

OsamaKhan_0-1616604463917.png

 

1. Password sent in Clear Text - CWE-319.

Some applications transmit passwords over unencrypted connections, making them vulnerable to interception. To exploit this vulnerability, an attacker must be suitably positioned to eavesdrop on the victim's network traffic. This scenario typically occurs when a client communicates with the server over an insecure connection such as public Wi-Fi, or a corporate or home network that is shared with a compromised computer.

 

2. Forced Browsing - CWE-285.

It was observed that The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

 

3. Absence of CSRF tokens.

No Anti-CSRF tokens were found in a HTML submission form.
A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their knowledge or intent in order to perform an action as the victim. The underlying cause is application functionality using predictable URL/form actions in a repeatable way. The nature of the attack is that CSRF exploits the trust that a web site has for a user. By contrast, cross-site scripting (XSS) exploits the trust that a user has for a web site. Like XSS, CSRF attacks are not necessarily cross-site, but they can be. Cross-site request forgery is also known as CSRF, XSRF, one-click attack, session riding, confused deputy, and sea surf.

 

4.No logout option - CWE-613.

It was observed that the target web application has no logout option.

 

5.Referrer-Policy Header is not implemented - CWE-200

It was observed that Referrer-policy is not implemented in the response header.
Referrer-Policy is a security header designed to prevent cross-domain referrer leakage.

 

 

Thanks In advance,

 

 

 

 

Thanks and Regards,
OK.
0 REPLIES 0
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!