Skip to main content

Use of an insecure channel - HTTP

Description

Client information is transmitted over port 80 or HTTP, a channel that does not use encryption, so credentials and confidential information can be captured in plain text.

Impact

Compromise sensitive information that travels in plain text.

Recommendation

Deploy the application over the HTTPS secure channel using TLS.

Threat

Anonymous attacker on adjacent network running a MitM.

Expected Remediation Time

⌚ 60 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: A
  • Attack complexity: H
  • Privileges required: N
  • User interaction: R
  • Scope: U
  • Confidentiality: L
  • Integrity: L
  • Availability: N

Temporal

  • Exploit code madurity: P
  • Remediation level: O
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:X
  • Score:
    • Base: 3.7
    • Temporal: 3.4
  • Severity:
    • Base: Low
    • Temporal: Low

Code Examples

Compliant code

The resource has https channel over tls securely configured

resource "azurerm_storage_account" "not_vulnerable" {
name = "storageaccountname"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
account_tier = "Standard"
account_replication_type = "GRS"
min_tls_version = "TLS1_2"
queue_properties {
logging {
delete = true
read = true
write = true
version = "1.0"
retention_policy_days = 10
}
}
network_rules {
default_action = "Deny"
}
}

Non compliant code

The resource uses an insecure http configuration

resource "azurerm_storage_account" "vulnerable" {
name = "storageaccountname"
resource_group_name = azurerm_resource_group.example.name
location = azurerm_resource_group.example.location
account_tier = "Standard"
account_replication_type = "GRS"
min_tls_version = "TLS1_0"
enable_https_traffic_only = false
queue_properties {
logging {
delete = true
read = true
write = true
version = "1.0"
retention_policy_days = 10
}
}
network_rules {
default_action = "Deny"
}
}

The resource has unsafe protocol enabled

ELBv2targetGroup2:
Type: AWS::ElasticLoadBalancingV2::TargetGroup
Properties:
HealthCheckEnabled: false
Name: MyTargets
Protocol: HTTP
TargetType: lambda
Targets:
- Id: [ MyLambdaFunction, Arn ]

Using the AWS CLI, the following command returns security groups that have ingress rules that allow HTTP traffic

$ aws ec2 describe-security-groups
--region us-east-1
--filters Name=ip-permission.from-port,Values=80 Name=ip-permission.to-port,Values=80 Name=ip-permission.cidr,Values='0.0.0.0/0'
--query 'SecurityGroups[*].{Name:GroupName}'

The command output returns any EC2 security groups that allow unrestricted HTTP access

Requirements

free trial

Search for vulnerabilities in your apps for free with our automated security testing! Start your 21-day free trial and discover the benefits of our Continuous Hacking Machine Plan. If you prefer a full service that includes the expertise of our ethical hackers, don't hesitate to contact us for our Continuous Hacking Squad Plan.