In which case does the Security misconfiguration vulnerability apply to?afpv PWwTumNn heiondKk 123Rr onn O
Our web application uses a HTML file with jQuery embedded inside. According to jQuery license (https://jquery.org/license/), we have to leave the license header in tact, including the version number.
However our client reported this as a security risk as the version number is exposed. Strangely, bootstrap version in the same file is not reported as a security risk.
Many applications use libraries with version numbers inside, it's even possible to get version numbers by running some code in Firebug or Chrome's Developer Console.
In which case this vulnerability (https://www.owasp.org/index.php/Top_10-2017_A6-Security_Misconfiguration) applies? And how can we resolve this issue without violating jQuery license?
-
I think you have a logic error in that information disclosure is being equated as a security misconfiguration. They are in no way the same or related. – schroeder♦ 7 hours ago
-
"Strangely, bootstrap version in the same file is not reported as a security risk." They might have randomly spotted the jQuery version number and reported that. Or they might think that it's redundant to nitpick over every version number they found. Or their automated tool just spotted the jQuery one. Just like software is never bug-free because the programmer doesn't think of every edge case or know every quirk (or perhaps doesn't get enough time to do so), pentesting is also an inexact business. – Luc 7 hours ago
-
Removing the version number from the license file would not help you anyways, because an attacker can just check manually what version you are using. – MechMK1 3 hours ago
3 Answers
Knowing the version number is not a security misconfiguration. The risk of exposing version numbers is an "information disclosure". This can create a hazard if knowing this information equips an attacker to craft an exploit for a vulnerability in that specific version.
Even if the library ends up containing a vulnerability, it is still not a security misconfiguration issue. That would be "A9-Using Components with Known Vulnerabilities".
So, it appears that the client has an incorrect and rigid understanding of the risks and the situation.
The security impact of exposing the version number is that an attacker can instantly see whether your version is vulnerable to a known vulnerability. For example, jQuery before 3.4.0 is vulnerable to CVE-2019-11358, so it is useful information for an attacker to know whether your jQuery is 3.3.9 or 3.4.1.
However, with JavaScript that runs in the browser the complete source code is accessible by the attacker, so it is impossible to hide whether your jQuery is vulnerable. Even if you hide the version, the attacker can compare the code, or just try an exploit, to determine whether you are vulnerable. Hiding the version number may make it slightly more work, but realisticly it accomplishes little.
Furthermore, there are other ways to mitigate this:
- Keep in the loop about security problems in the libraries you use. Subscribe to a mailing list or another publishing method for security problems.
- Update the client libraries whenever a security problem is identified.
If you always have a non-vulnerable version because you update regurarly, it is no problem that the version is disclosed. And you can tell your client that this is the way you mitigate the information disclosure.
-
Agreed, just a small note: "Hiding the version number may make it slightly more work" I'd argue it's a bit more than "slightly": in order to map code back to a version number (in order to plug that version number into a CVE search), you have to have an index of all variants (minified, maybe with different packers) of all versions of all relevant libraries. A dedicated attacker might do this if they suspect there will be an exploitable vulnerability, but most of the time, the vulns of client-side libraries are not reachable or have a limited impact. I think few attackers would bother. – Luc 7 hours ago
I'm not 100% sure whether or not this is a duplicate question, if it should be marked as such please do so mods, but I think that the advice in this particular post "Is there a base version of jQuery which has no XSS Vulnerability" would be useful in solving the problem for your clients.
One of the main factors you'll have to evaluate in addressing the general question is whether the proposed security solution is a good ROI for your client, is it worth writing an exception into the security policy, or perhaps implementing code to strip out the version numbers returned (or as the commenter notes potentially ditching jQuery) to mitigate the risk of exposing the version number. In many cases it won't be, but in other it will, and it will all depend on the individual situation. However, you should definitely verify the versions that you are using aren't already compromised by using something like cvedetails or the NIST National Vulnerability Database.
As to why Bootstrap is reported that is likely down to the scanner (which you didn't mention) and tests you're using for evaluation. According to the logic of the OWASP Security Misconfiguration it could be seen as a vulnerability as well and should/should not be addressed for the same reason. Regardless, exposing that information does give any potential attacker another data point from which to conduct research and potentially identify vulnerabilities.
