COMMON WEAKNESS ENUMERATIONIncomplete

CWE-1428

Reliance on HTTP instead of HTTPS

The product provides or relies on use of HTTP communications when HTTPS is available.

Soyutlama

Base

Yapı

Simple

Sömürü İhtimali

Medium

Problemi anla

Problem nedir?

The product provides or relies on use of HTTP communications when HTTPS is available.

Genişletilmiş açıklama

Because HTTP communications are not encrypted, HTTP is subject to various attacks against confidentiality, integrity, and authenticity. However, unlike many other protocols, HTTPS is widely available as a more secure alternative, because it uses encryption.

Kök neden

Problem nasıl ve ne zaman oluşur?

Yaşam döngüsü evresi

Architecture and Design

The product might be designed in a way that assumes that HTTP will be used, e.g., by excluding considerations of encrypted communications between client and server.

Yaşam döngüsü evresi

Requirements

Product requirements might not include encrypted communications, which could make it easier for designers and developers to choose HTTP.

Yaşam döngüsü evresi

Implementation

Developers might choose to use unencrypted protocols such as HTTP because they would not require development of additional mechanisms to support encryption, e.g., key or certificate management.

Yaşam döngüsü evresi

Implementation

When generating content that references web sites such as email messages, ensure that the https:// prefix is included. If a domain name is presented without such a prefix, then clients might automatically treat the link as if it had an "http" prefix. For example, referencing a domain like "mysite.example.com" could cause it to be treated like "http://mysite.example.com", thereby sending unencrypted HTTP requests.

Yaşam döngüsü evresi

Operation

Designers might assume that the responsibility for encrypted communications might belong to operators and/or network administrators.

Risk

Başarılı sömürü neye yol açar?

Read Application DataModify Application Data

Etkilenen güvenlik alanları: Confidentiality, Integrity

HTTP can be subjected to attacks against confidentiality (by reading cleartext packets); integrity (by modifying sessions); and authenticity (by compromising servers and/or clients using cache poisoning, phishing, or other attacks that enable attackers to spoof a legitimate entity in the communication channel).

Savunma

Nasıl önlenir ve çözülür?

Architecture and Design

Mimari ve tasarım yaklaşımı

Detay
Explicitly require HTTPS or another mechanism that ensures that communication is encrypted [REF-1464].

Implementation

Uygulama aşaması savunması

Detay
Avoid using "mixed content," i.e., serving a web page over HTTPS in which the page includes elements that use "http:" URLs [REF-1466] [REF-1467]. This is often done for images or other resources that do not seem to have privacy or security implications.

Implementation · Operation

Birden fazla yaşam döngüsü evresinde uygulanacak savunma

Detay
Perform "HTTPS forcing," that is, redirecting HTTP requests to HTTPS.

Operation

Operasyonel savunma

Detay
If the product supports multiple protocols, ensure that encrypted protocols (such as HTTPS) are required, and remove any unencrypted protocols (such as HTTP).
CWE-1428: Common Weakness Enumeration Entry CWE-1428 · DayBreach Sözlük · DayBreach