Project: WASC Threat Classification

Threat Type: Weakness

Reference ID: WASC-04

Insufficient Transport Layer Protection

Insufficient transport layer protection allows communication to be exposed to untrusted third-parties, providing an attack vector to compromise a web application and/or steal sensitive information. Websites typically use Secure Sockets Layer / Transport Layer Security (SSL/TLS) to provide encryption at the transport layer [1]. However, unless the website is configured to use SSL/TLS and configured to use SSL/TLS properly, the website may be vulnerable to traffic interception and modification.

Lack of Transport Layer Encryption

When the transport layer is not encrypted, all communication between the website and client is sent in clear-text which leaves it open to interception, injection and redirection (also known as a man-in-the-middle/MITM attack). An attacker may passively intercept the communication, giving them access to any sensitive data that is being transmitted such as usernames and passwords. An attacker may also actively inject/remove content from the communication, allowing the attacker to forge and omit information, inject malicious scripting, or cause the client to access remote untrusted content. An attacker may also redirect the communication in such a way that the website and client are no longer communicating with each other, but instead are unknowingly communicating with the attacker in the context of the other trusted party.

Weak Cipher Support

Historically, high grade cryptography was restricted from export to outside the United States[2]. Because of this, websites were configured to support weak cryptographic options for those clients that were restricted to only using weak ciphers. Weak ciphers are vulnerable to attack because of the relative ease of breaking them; less than two weeks on a typical home computer and a few seconds using dedicated hardware[3].

Today, all modern browsers and websites use much stronger encryption, but some websites are still configured to support outdated weak ciphers. Because of this, an attacker may be able to force the client to downgrade to a weaker cipher when connecting to the website, allowing the attacker to break the weak encryption. For this reason, the server should be configured to only accept strong ciphers and not provide service to any client that requests using a weaker cipher. In addition, some websites are misconfigured to choose a weaker cipher even when the client will support a much stronger one. OWASP offers a guide to testing for SSL/TLS issues, including weak cipher support and misconfiguration[4], and there are other resources and tools [5][6] as well.

Mixed Content

Websites that serve a web page using transport layer protection (HTTPS), but then also include additional content on the page such as JavaScript or images over HTTP are using mixed content and are vulnerable to attack. An attacker could replace the legitimate JavaScript being sent to the browser with a malicious version and have it execute in the context of the HTTPS page[7][8]. All content on a secure page must be served via HTTPS, including the HTML, JavaScript, images, CSS, XHR, and any other content.

A similar attack may be used to force a browser into sending a cookie normally transmitted over HTTPS to the HTTP version of the site, exposing the cookie. Cookies should be set with the “secure” flag (and if possible, the “HTTPOnly” flag) to prevent the cookie from being leaked[9].