Dear all.
Today I decided to use a quick online available tool to scan the steemit.com website for vulnerabilities.
In the past I used this to see how an internal website in a company was secured.
So I started this test on https://pentest-tools.com/website-vulnerability-scanning/web-server-scanner
The results were not bad, but:
1 medium vulnerability was found
What does this mean, and how bad is it?
Risk description:
Since the Secure flag is not set on the cookie, the browser will send it over an unencrypted channel (plain HTTP) if such a request is made. Thus, the risk exists that an attacker will intercept the clear-text communication between the browser and the server and he will steal the cookie of the user. If this is a session cookie, the attacker could gain unauthorized access to the victim's web session.
Lack of the HttpOnly flag permits the browser to access the cookie from client-side scripts (ex. JavaScript, VBScript, etc). This can be exploited by an attacker in conjuction with a Cross-Site Scripting (XSS) attack in order to steal the affected cookie. If this is a session cookie, the attacker could gain unauthorized access to the victim's web session.
Recommendation:
We recommend reconfiguring the web server in order to set the flag(s) Secure, HttpOnly to all sensitive cookies.
So I think Steemit.inc must look to this message and act to at least solve it. I guess a lot of people don't like:
This can be exploited by an attacker in conjuction with a Cross-Site Scripting (XSS) attack in order to steal the affected cookie. If this is a session cookie, the attacker could gain unauthorized access to the victim's web session.
Kind regards,
Ron
Posted on Utopian.io - Rewarding Open Source Contributors