ZAP Full Scan Report

[github-actions]

• Site: https://localhost
  New Alerts

  • HTTP Only Site [10106] total: 1:
    • http://localhost:8080

• Site: http://localhost:8080
  New Alerts

  • Apache Range Header DoS (CVE-2011-3192) [10053] total: 20:
    • http://localhost:8080/js/showdown-1.9.1.js
    • http://localhost:8080/robots.txt
    • http://localhost:8080/css/bootstrap/bootstrap-theme-3.4.1.css
    • http://localhost:8080/css/bootstrap/privatebin.css?1.3.4
    • http://localhost:8080/js/privatebin.js?1.3.4
    • ..
  • X-Content-Type-Options Header Missing [10021] total: 12:
    • http://localhost:8080/robots.txt
    • http://localhost:8080/manifest.json?1.3.4
    • http://localhost:8080/img/favicon-16x16.png?1.3.4
    • http://localhost:8080/css/noscript.css
    • http://localhost:8080/img/favicon.ico
    • ..
  • Modern Web Application [10109] total: 5:
    • http://localhost:8080
    • http://localhost:8080/js/privatebin.js?1.3.4
    • http://localhost:8080/sitemap.xml
    • http://localhost:8080/js/jquery-3.4.1.js
    • http://localhost:8080/
  • .env Information Leak [40034] total: 6:
    • http://localhost:8080/css/prettify/.env
    • http://localhost:8080/js/.env
    • http://localhost:8080/.env
    • http://localhost:8080/css/bootstrap/.env
    • http://localhost:8080/img/.env
    • ..
  • CSP: Wildcard Directive [10055] total: 3:
    • http://localhost:8080
    • http://localhost:8080/sitemap.xml
    • http://localhost:8080/
  • User Agent Fuzzer [10104] total: 20:
    • http://localhost:8080/css/prettify
    • http://localhost:8080/css
    • http://localhost:8080/css
    • http://localhost:8080/img
    • http://localhost:8080/css/bootstrap
    • ..
  • Anti-CSRF Tokens Check [20012] total: 3:
    • http://localhost:8080
    • http://localhost:8080/sitemap.xml
    • http://localhost:8080/
  • Timestamp Disclosure - Unix [10096] total: 5:
    • http://localhost:8080/css/bootstrap/bootstrap-3.4.1.css
    • http://localhost:8080/css/bootstrap/bootstrap-3.4.1.css
    • http://localhost:8080/css/bootstrap/bootstrap-3.4.1.css
    • http://localhost:8080/css/bootstrap/bootstrap-3.4.1.css
    • http://localhost:8080/css/bootstrap/bootstrap-3.4.1.css
  • Trace.axd Information Leak [40029] total: 6:
    • http://localhost:8080/js/trace.axd
    • http://localhost:8080/css/bootstrap/trace.axd
    • http://localhost:8080/css/trace.axd
    • http://localhost:8080/img/trace.axd
    • http://localhost:8080/trace.axd
    • ..
  • Information Disclosure - Suspicious Comments [10027] total: 15:
    • http://localhost:8080/js/prettify.js?1.3.4
    • http://localhost:8080/js/legacy.js?1.3.4
    • http://localhost:8080/js/privatebin.js?1.3.4
    • http://localhost:8080/js/jquery-3.4.1.js
    • http://localhost:8080/js/privatebin.js?1.3.4
    • ..
  • Absence of Anti-CSRF Tokens [10202] total: 3:
    • http://localhost:8080
    • http://localhost:8080/
    • http://localhost:8080/sitemap.xml
  • CSP: Notices [10055] total: 3:
    • http://localhost:8080/sitemap.xml
    • http://localhost:8080/
    • http://localhost:8080
  • Vulnerable JS Library [10003] total: 2:
    • http://localhost:8080/js/bootstrap-3.3.7.js
    • http://localhost:8080/js/jquery-3.4.1.js
  • Cloud Metadata Potentially Exposed [90034] total: 1:
    • http://localhost:8080/latest/meta-data/

View the following link to download the report.
RunnerID:716506686

[rugk]

BTW, the HTML report goes into more details…

Apache Range Header DoS (CVE-2011-3192) [10053] total: 20:

Huh? We don't even use Apache… 🙈

User Agent Fuzzer [10104] total: 20:

It claims with a different User-Agent different things are returned… I doubt… so… ?

(see HTMl for example URls etc)

---

Also ignored some more rules & false-positives: #30

---

The other results are valid and basically covered by a stricter CSP (PrivateBin/PrivateBin#108) and stuff like that,

[rugk]

BTW also checked the production website with https://observatory.mozilla.org/analyze/privatebin.net and we get an A+.
Also, it returns the content-type-header, so you likely do that in your own nginx config there.

[elrido]

Yes, these settings are packaged into the nginx container that contains and hosts the static site and are found here:
https://github.com/PrivateBin/privatebin.info-pelican/blob/3637cc005be7c28992eb3d6ceef122fb25145b43/nginx.conf#L107-L115

[github-actions]

• Site: http://localhost:8080
  Resolved Alerts

  • Apache Range Header DoS (CVE-2011-3192) [10053] total: 20:
  • .env Information Leak [40034] total: 6:
  • Anti-CSRF Tokens Check [20012] total: 3:
  • Trace.axd Information Leak [40029] total: 6:
  • Cloud Metadata Potentially Exposed [90034] total: 1:

  Ignored Alerts

  • Information Disclosure - Suspicious Comments [10027] total: 12:
  • Timestamp Disclosure - Unix [10096] total: 5:
  • Absence of Anti-CSRF Tokens [10202] total: 3:

View the following link to download the report.
RunnerID:719746958

[github-actions]

• Site: http://localhost:8080
  New Alerts

  • Multiple X-Frame-Options Header Entries [10020] total: 3:
    • http://localhost:8080
    • http://localhost:8080/sitemap.xml
    • http://localhost:8080/

  Resolved Alerts

  • X-Content-Type-Options Header Missing [10021] total: 12:

View the following link to download the report.
RunnerID:754213528

[elrido]

Ok, I think we may have to go for a more complex solution. I'll try to use a map to add only missing headers, so they aren't duplicated for the dynamic content.

[rugk]

…uhm… ok, as long as that is not a too big negative performance impact.

[elrido]

FYI, in 453cff7 I ended up using a different approach to solve this: I remove these headers if present in the fastCGI response, then always set them with the rule we previously introduced. The problem is that nginx' add_header only adds headers and there is no mod or other command to replace headers, so the map approach didn't work out in my tests. Aside: maps are more performant then if-conditions, in nginx configs.

[github-actions]

• Site: http://localhost:8080
  Resolved Alerts
  • Multiple X-Frame-Options Header Entries [10020] total: 3:

View the following link to download the report.
RunnerID:759852652

[elrido]

There are only two medium issues remaining:

• these 3 directives are not defined or use a wildcard in our CSP rule: connect-src, frame-ancestors, form-action - I think the last one is already tracked over in the main project. The connect-src * is required for the paste manager feature, if a site wants allows other instances to use it's API for data storage. frame-ancestors isn't tracked, AFAIK.
• "The identified library bootstrap, version 3.3.7 is vulnerable." Fair point and so is our jQuery version - both are tracked in the main project and bootstrap 3 is the reason we haven't been able to upgrade jQuery as with >=3.5 our bootstrap breaks.

On the other reports: None of our forms make use of Anti-CSRF tokens, because none of them are sent to the server - all are processed on the JS side.

[rugk]

form-action - I think the last one is already tracked over in the main project.

correct: PrivateBin/PrivateBin#778

jQuery: PrivateBin/PrivateBin#608

[github-actions]

• Site: http://localhost:8080
  Resolved Alerts

  • User Agent Fuzzer [10104] total: 20:

  Ignored Alerts

  • CSP: Wildcard Directive [10055] total: 3:
  • Modern Web Application [10109] total: 5:
  • CSP: Notices [10055] total: 3:

View the following link to download the report.
RunnerID:775043757

[github-actions]

• Site: http://localhost:8080
  New Alerts
  • Hidden File Found [40035] total: 1:
    • http://localhost:8080/.svn/entries

View the following link to download the report.
RunnerID:966558993

[elrido]

svn_dir: We let all requests that don't match a static file (css, js, images) be handled by the index.php, so it just returns the app on that path.

[github-actions]

• Site: http://localhost:8080
  Resolved Alerts
  • Hidden File Found [40035] total: 1:

View the following link to download the report.
RunnerID:973478204

[rugk]

Closing this as ZAP has apparently decided to use a new issue for the reports hehe: #69