GET: Web Application Security Finding Details – Bitsight Knowledge Base

Publication Date: August 11, 2023

https://api.bitsighttech.com/ratings//v1/companies/company_guid/findings?risk_vector=web_appsec

Get an organization’s Web Application Security finding details.

Parameters

For details specific to Web Application Security, use the ?risk_vector=web_appsec parameter. Other query parameters are listed in GET: Finding Details.

Example Request

curl https://api.bitsighttech.com/ratings/v1/companies/a940bb61-33c4-42c9-9231-c8194c305db3/findings?risk_vector=web_appsec -u entity_guid/assets -u API_token:

Example Responses

Cross-Site Scripting

Cross-Domain Subresource Integrity Check
Cross-Domain Subresource Integrity Failure
Content Security Policy Configurations
CSP Violations

Components with Known Vulnerabilities

Javascript Libraries with Known Vulnerabilities

Broken Authentication and Access Control

CMS Administration Portal Exposed
Cross-site Request Forgery (CSRF) Mitigations Present
Authentication on Insecure Channel

Sensitive Data Exposure

Secure Cookie Set on Insecure Channel
Session Token in URL
Mixed Content
HSTS Preload Directive Present
Cookie SameSite Attribute
Cookie SameSite Blocked
Unsafe Referrer Policy

Security Misconfiguration

Internal Server Error
Reverse Tabnabbing
TLS Errors on Page Resource Fetch
Directory Listing Exposure
CORS Violation
Overly Permissive CORS Whitelist
HTTPS to HTTP Redirects

Cross-Site Scripting: Cross-Domain Subresource Integrity Check

Field		Description
diligence_annotations Array		List of all evidence associated with the assessment

	assessmentName String	Name of the assessment that this evidenced is associated to. For this type, the name will always be `cross_domain_subresource_integrity_check`.
	status String	Test result associated to this evidence. Either Pass of Failed.
	severity String	Severity associated to this evidence.
	type String	The type of HTML resource.
	resource String [URL]	Link defined in web application to the resource.
	hash String	If available, the hash value present in the HTML element.

[
    {
        "type": "link",
        "resource": "[url]",
        "hash": "Integrity attribute missing",
        "status": "Failed",
        "severity": "Minor",
        "assessmentName": "cross_domain_subresource_integrity_check"
    },
    {
        "type": "script",
        "resource": "[url]",
        "hash": "Integrity attribute missing",
        "status": "Failed",
        "severity": "Minor",
        "assessmentName": "cross_domain_subresource_integrity_check"
    }   
]

Cross-Site Scripting: Cross-Domain Subresource Integrity Failure

Field		Description
diligence_annotations Array		List of all evidence associated with the assessment

	assessmentName String	Name of the assessment that this evidence is associated to. For this type, the name will always be `cross_domain_subresource_integrity_failure`
	status String	Test result associated to this evidence. Either Pass or Failed.
	severity String	Severity associated to this evidence.
	type String	The type of HTML resource.
	resource String [URL]	Link defined in web application to the resource.
	hash String	If available, the hash value present in the HTML element.

[
    {
        "type": "Script",
        "resource": "[url]",
        "hash": "Failed to find a valid digest in the 'integrity' attribute for resource '[url]' with computed SHA-256 integrity 'CdZ5YfsFUiC3gCJeUOvnoduGoxgDH0EugrrlwIuw+U4='. The resource has been blocked.",
        "resolution": "blocked",
        "status": "Failed",
        "severity": "Moderate",
        "assessmentName": "cross_domain_subresource_integrity_failure"
    }
]

Cross-Site Scripting: Content Security Policy Configurations

Field		Description
diligence_annotations Array		List of all evidence associated with the assessment

	assessmentName String	Name of the assessment that this evidence is associated to. For this type, the name will always be `content_security_policy`.
	status String	Test result associated to this evidence. Either Pass or Failed.
	severity String	Severity associated to this evidence.
	documentUrl String [URL]	URL that was loaded to retrive the CSP configuration
	source String	Location where the CSP configuration was loaded from.
	directive String	CSP directive evaluated in a pice of particular evidence.
	value String	Value of the CSP directive.
	cspSeverity Integer	Severity of the CSP directive that will be used to grade.
	type Integer	The type of HTML resource.

[
    {
        "message": "'unsafe-inline' allows the execution of unsafe in-page scripts and event handlers.",
        "documentUrl": "[url]",
        "source": "header",
        "directive": "script-src",
        "value": [
            "'unsafe-inline'"
        ],
        "cspSeverity": 10,
        "type": 301,
        "status": "Failed",
        "severity": "Moderate",
        "assessmentName": "content_security_policy"
    },
    {
        "message": "'unsafe-eval' allows the execution of code injected into DOM APIs such as eval().",
        "documentUrl": "[url]",
        "source": "header",
        "directive": "script-src",
        "value": [
            "'unsafe-eval'"
        ],
        "cspSeverity": 50,
        "type": 302,
        "status": "Failed",
        "severity": "Moderate",
        "assessmentName": "content_security_policy"
    }
]

Cross-site Scripting: CSP Violations

Field		Description
diligence_annotations Array		List of all evidence associated with the assessment.

	assessmentName String	Name of the assessment that this evidenced is associated to. For this type, the name will always be `csp_violation`.
	status String	Test result associated to this evidence. Either Pass or Failed.
	severity String	Severity associated to this evidence.
	resolutionStatus String	Action the browser took when loading the resource.
	lineNumber Integer	Line number in the source page.
	message String	Detailed message of why a specific element caused the CSP violation.
	resourceUrl String [URL]	URL of the resource that generated the CSP violation.

[
    {
        "lineNumber": 165,
        "resolutionStatus": "blocked",
        "message": "Refused to load the script '[url]' because it violates the following Content Security Policy directive: \"script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.youtube.com\". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.\n",
        "resourceUrl": "[url]",
        "status": "Failed",
        "severity": "Moderate",
        "assessmentName": "csp_violation"
    },
    {
        "lineNumber": 859,
        "resolutionStatus": "blocked",
        "message": "Refused to load the script '[url]' because it violates the following Content Security Policy directive: \"script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.youtube.com\". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.\n",
        "resourceUrl": "[url]",
        "status": "Failed",
        "severity": "Moderate",
        "assessmentName": "csp_violation"
    }
]

Components with Known Vulnerabilities: Javascript Libraries with Known Vulnerabilities

Field			Description
diligence_annotations Array			List of all evidence associated with the assessment.

	assessmentName String		Name of the assessment that this evidence is associated to. For this type, the name will always be `javascript_library_vulnerabilities`.
	status String		Test result associated to this evidence. Either Pass or Failed.
	severity String		Severity associated to this evidence.
	library String		Name of the Javascript library.
	cpe String		Common Platform Enumeration name for this library, if available.
	cves Array		List of CVEs that are associated with this library.

		cveId String	Identifier of one specific CVE associated with this library.

[
    {
        "library": "Google Tag Manager",
        "status": "Pass",
        "severity": "Material",
        "assessmentName": "javascript_library_vulnerabilities"
    },
    {
        "library": "jquery",
        "version": "1.11.0",
        "cves": [
            {"cveId": "CVE-2020-11023"},
            {"cveId": "CVE-2020-11022"},
            {"cveId": "CVE-2015-9251" },
            {"cveId": "CVE-2019-11358"}
        ],
        "cpe": "cpe:/a:jquery:jquery",
        "status": "Failed",
        "severity": "Material",
        "assessmentName": "javascript_library_vulnerabilities"
    }
]

Broken Authentication and Access Control: CMS Administration Portal Exposed

Field		Description
diligence_annotations Array		List of all evidence associated with the assessment.

	assessmentName String	Name of the assessment that this evidence is associated to. For this type, the name will always be `exposed_csm_admin_page`.
	status String	Test result associated to this evidence. Either Pass or Failed.
	severity String	Severity associated to this evidence.
	cms String	Name of the CMS that was identified.
	location String [URL]	URL of the login page that was identified.

[
    {
        "cms": "Wordpress",
        "location": "[url]",
        "status": "Failed",
        "severity": "Moderate",
        "assessmentName": "exposed_cms_admin_page"
    }
]

Broken Authentication and Access Control: Cross-Site Request Forgery (CSRF) Mitigations Present

Field		Description
diligence_annotations Array		List of all evidence associated with the assessment.

	assessmentName String	Name of the assessment that this evidence is associated to. For this type, the name will always be `cross_site_request_forgery`.
	status String	Test result associated to this evidence. Either Pass or Failed.
	severity String	Severity associated to this evidence.
	documentUrl String [URL]	URL of the page that contains the token.
	name String	Name of the token.
	value String	Value of the token.
	path String	Path of the HTML element within the page.

[
    {
        "documentUrl": "[url]",
        "name": "input types",
        "value": "text",
        "path": "/html/body#home/div/footer/div/form#mobile-footer-search",
        "status": "Failed",
        "severity": "Minor",
        "assessmentName": "cross_site_request_forgery"
    },
    {
        "documentUrl": "[url]",
        "name": "input types",
        "value": "text",
        "path": "/html/body#home/div#offCanvasNestedOverlap/div/form#mobile-search",
        "status": "Failed",
        "severity": "Minor",
        "assessmentName": "cross_site_request_forgery"
    }
]

Broken Authentication and Access Control: Authentication on Insecure Channel

Field		Description
diligence_annotations Array		List of all evidence associated with the assessment.

	assessmentName String	Name of the assessment that this evidence is associated to. For this type, the name will always be `authentication_on_insecure_channel`.
	status String	Test result associated to this evidence. Either Pass or Failed.
	severity String	Severity associated to this evidence.
	name String	Name of the HTML element that represents an authentication mechanism
	message String	Detailed message of the identified issue.
	details String	Additional details of the HTML element identified.
	authCategory String	Category of the issue. Values: `auth_on_insecure_channel` `password_on_insecure_channel_ssl_cert_error` `password_on_insecure_channel_ssl_obsolete_connection_error` `password_on_insecure_channel`
	resource String [URL]	URL of the application that sent the WWW-Authenticate header.

[
    {
        "name": "input",
        "message": "Password input field present in a form on a non-HTTPS page",
        "details": "size=\"5\" name=\"password\" style=\"width:100px\" type=\"password\"",
        "authCategory": "password_on_insecure_channel",
        "status": "Failed",
        "severity": "Material",
        "assessmentName": "authentication_on_insecure_channel"
    },
    {
        "name": "WWW-Authenticate",
        "message": "WWW-Authenticate header present on a non-HTTPS page.",
        "resource": "[url]",
        "authCategory": "auth_on_insecure_channel",
        "status": "Failed",
        "severity": "Material",
        "assessmentName": "authentication_on_insecure_channel"
    }


]

Field		Description
diligence_annotations Array		List of all evidence associated with the assessment.

	assessmentName String	Name of the assessment that this evidence is associated to. For this type, the name will always be `cross_domain_subresource_integrity_check`.
	status String	Test result associated to this evidence. Either Pass or Failed.
	severity String	Severity associated to this evidence.
	name String	Name of the cookie.

[
    {
        "name": "GUEST_LANGUAGE_ID",
        "status": "Failed",
        "severity": "Minor",
        "assessmentName": "secure_cookie_on_insecure_channel"
    },
    {
        "name": "COOKIE_SUPPORT",
        "status": "Failed",
        "severity": "Minor",
        "assessmentName": "secure_cookie_on_insecure_channel"
    }
]

Sensitive Data Exposure: Session Token in URL

Field		Description
diligence_annotations Array		List of all evidence associated with the assessment.

	assessmentName String	Name of the assessment that this evidence is associated to. For this type, the name will always be `session_token_in_url`.
	status String	Test result associated to this evidence. Either Pass or Failed.
	severity String	Severity associated to this evidence.
	name String	Name of the attribute that contains a session token.
	value String	Value of the session token.
	resource String [URL]	Full URL that contains the session token.

[
    {
        "name": "sid",
        "value": "1234567890",
        "resource": "[url]",
        "status": "Failed",
        "severity": "Minor",
    "assessmentName": "session_token_in_url"
    },
    {
        "name": "id",
        "value": "0987654321",
        "resource": "[url]",
        "status": "Failed",
        "severity": "Minor",
    "assessmentName": "session_token_in_url"
    }
]

Sensitive Data Exposure: Mixed Content

Field		Description
diligence_annotations Array		List of all evidence associated with the assessment.

	assessmentName String	Name of the assessment that this evidence is associated to. For this type, the name will always be `mixed_content`.
	status String	Test result associated to this evidence. Either Pass or Failed.
	severity String	Severity associated to this evidence.
	type String	Resrouce type.
	resolution String	Action the browser took when loading the resource. [blocked, warning, upgraded]
	resource String [URL]	Link defined in web application to the resource.
	details String	Detailed message of the resolution reason provided by the browser.

[
    {
        "type": "IMAGE",
        "resolution": "upgraded",
        "resource": "[url]",
        "details": "Mixed Content: The page at '[url]' was loaded over HTTPS, but requested an insecure element '[url]'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html",
        "status": "Failed",
        "severity": "Minor",
        "assessmentName": "mixed_content"
    },
    {
        "type": "FORM",
        "resolution": "warning",
        "resource": "[url]",
        "details": "Mixed Content: The page at '[url]' was loaded over a secure connection, but contains a form that targets an insecure endpoint '[url]'. This endpoint should be made available over a secure connection.",
        "status": "Failed",
        "severity": "Material",
        "assessmentName": "mixed_content"
    }
]

Sensitive Data Exposure: HSTS Preload Directive Present

Field		Description
diligence_annotations Array		List of all evidence associated with the assessment.

	assessmentName String	Name of the assessment that this evidence is associated to. For this type, the name will always be `hsts_preload_present`.
	status String	Test result associated to this evidence. Either Pass or Failed.
	severity String	Severity associated to this evidence.
	header String	Name of the HTTP header.
	value String	Value of the HTTP header.

[
    {
        "header": "Strict-Transport-Security",
        "value": "max-age=63072000; includeSubDomains; preload",
        "status": "Pass",
        "severity": "Minor",
        "assessmentName": "hsts_preload_present"
    }
]

Sensitive Data Exposure: Cookie SameSite Attribute

Field		Description
diligence_annotations Array		List of all evidence associated with the assessment.

	assessmentName String	Name of the assessment that this evidence is associated to. For this type, the name will always be `cookie_same_site_attribute`.
	status String	Test result associated to this evidence. Either Pass or Failed.
	severity String	Severity associated to this evidence.
	name String	Name of the cookie
	value String	Value contained in the cooke.
	attributes String	All attributes associated with the cooke.

[
    {
        "name": "TS0...b0b",
        "message": "Cookie does not have the SameSite attribute",
        "value": "017aab903c93f57f8079...2ba5a47e3e6799c7f53c",
        "attributes": "TS0...b0b=017aab903c93f57f8079...2ba5a47e3e6799c7f53c; Path=/; Domain=[url]; Secure",
        "status": "Failed",
        "severity": "Minor",
        "assessmentName": "cookie_same_site_attribute"
    },
    {
        "name": "TS0...026",
        "message": "Cookie does not have the SameSite attribute",
        "value": "013df855ab4843b6075b...0af49a41e4f30ec115b8",
        "attributes": "TS0...026=013df855ab4843b6075b...0af49a41e4f30ec115b8; Path=/; Domain=[url]; Secure",
        "status": "Failed",
        "severity": "Minor",
        "assessmentName": "cookie_same_site_attribute"
    }
]

Sensitive Data Exposure: Cookie SameSite Blocked

Field		Description
diligence_annotations Array		List of all evidence associated with the assessment.

	assessmentName String	Name of the assessment that this evidence is associated to. For this type, the name will always be `cookie_same_site_blocked`.
	status String	Test result associated to this evidence. Either Pass or Failed.
	severity String	Severity associated to this evidence.
	name String	Name of the cookie
	value String	Value contained in the cooke.
	attributes String	All attributes associated with the cooke.

[
    {
        "name": "ENTRY_KEY",
        "message": "A cookie was blocked due to SameSite policy violation for reason EXCLUDE_SAME_SITE_UNSPECIFIED_TREATED_AS_LAX",
        "resolution": "blocked",
        "attributes": "path=/; domain=[url]",
        "resourceUrl": "[url]",
        "status": "Failed",
        "severity": "Minor",
    "assessmentName": "cookie_same_site_blocked"
    },
    {
        "name": "TESTCOOKIES",
        "message": "A cookie was blocked due to SameSite policy violation for reason EXCLUDE_SAME_SITE_UNSPECIFIED_TREATED_AS_LAX",
        "resolution": "blocked",
        "attributes": "path=/embed; domain=[url]",
        "resourceUrl": "[url]",
        "status": "Failed",
        "severity": "Minor",
    "assessmentName": "cookie_same_site_blocked"
    }
]

Sensitive Data Exposure: Unsafe Referrer Policy

Field		Description
diligence_annotations Array		List of all evidence associated with the assessment.

	assessmentName String	Name of the assessment that this evidence is associated to. For this type, the name will always be `unsafe_referrer_policy`.
	status String	Test result associated to this evidence. Either Pass of Failed.
	severity String	Severity associated to this evidence.
	header String	Name of the header
	value String [URL]	Value of the header.

[
    {
        "header": "Referrer-Policy",
        "value": "unsafe-url",
        "status": "Failed",
        "severity": "Minor",
        "assessmentName": "unsafe_referrer_policy"
    }
]

Security Misconfiguration: Internal server error

Field		Description
diligence_annotations Array		List of all evidence associated with the assessment.

	assessmentName String	Name of the assessment that this evidence is associated to. For this type, the name will always be `internal_server_error`.
	status String	Test result associated to this evidence. Either Pass or Failed.
	severity String	Severity associated to this evidence.
	url String [URL]	Location that generated an internal server error response.
	message String	Detailed message about the error response.

[
    {
        "url": "[url]",
        "message": "Request produced a 500 Internal Server Error response",
        "status": "Failed",
        "severity": "Moderate",
        "assessmentName": "internal_server_error"
    }
]

Security Misconfiguration: Reverse Tabnabbing

Field		Description
diligence_annotations Array		List of all evidence associated with the assessment.

	assessmentName String	Name of the assessment that this evidenced is associated to. For this type, the name will always be `reverse_tabnabbing`.
	status String	Test result associated to this evidence. Either Pass or Failed.
	severity String	Severity associated to this evidence.
	resource String [URL]	Link of the resource to be loaded.
	attributes String	List of all attributes associated with this link.

[
    {
        "resource": "[url]",
        "attributes": "rel=\"noopener\" href=\"[url]\" class=\"m-last-foc m-last-foc-main\" target=\"_blank\"",
        "status": "Failed",
        "severity": "Minor",
        "assessmentName": "reverse_tabnabbing"
    }
]

Security Misconfiguration: TLS Errors on Page Resource Fetch

Field		Description
diligence_annotations Array		List of all evidence associated with the assessment

	assessmentName String	Name of the assessment that this evidence is associated to. For this type, the name will always be `tls_error`.
	status String	Test result associated to this evidence. Either Pass or Failed.
	severity String	Severity associated to this evidence.
	certificate String	If available, string representation of the certificate.
	message String	Detailed message describing the certificate error that was generated.
	hash String	Detailed message of the failure reason when validating the integrity attribute present in the HTML element.

[
    {
        "certificate": "MIIEPDCCAySgAwIBAg...+oghLrGREt",
        "message": "This site is missing a valid, trusted certificate (net::ERR_CERT_COMMON_NAME_INVALID).",
        "status": "Failed",
        "severity": "Moderate",
        "assessmentName": "tls_error"
    },
    {
        "message": "Obsolete connections settings: The connection to this site is encrypted and authenticated using TLS 1.2, ECDHE_RSA with P-384, and AES_256_CBC with HMAC-SHA1.",
        "status": "Failed",
        "severity": "Minor",
        "assessmentName": "tls_error"
    }
]

Security Misconfiguration: Directory listing exposure

Field		Description
diligence_annotations Array		List of all evidence associated with the assessment.

	assessmentName String	Name of the assessment that this evidence is associated to. For this type, the name will always be `directory_listing_exposure`.
	status String	Test result associated to this evidence. Either Pass or Failed.
	severity String	Severity associated to this evidence.
	url String [URL]	Location that is exposing a server directory listing.
	server String	If available, the server name.

[
    {
        "url": "[url]",
        "server": "Apache 2",
        "status": "Failed",
        "severity": "Minor",
        "assessmentName": "directory_listing_exposure"
    }
]

Security Misconfiguration: CORS Violation

Field		Description
diligence_annotations Array		List of all evidence associated with the assessment

	assessmentName String	Name of the assessment that this evidence is associated to. For this type, the name will always be `directory_listing_exposure`.
	status String	Test result associated to this evidence. Either Pass or Failed.
	severity String	Severity associated to this evidence.
	resolutionStatus String	Action the browser took when loading the resource. [blocked, warning]
	resource String [URL]	Link defined in web application to the resource.
	message String	Detailed message of the resolution reason provided by the browser.

[
    {
        "resource": "[url]",
        "resolutionStatus": "blocked",
        "message": "Access to font at '[url]' from origin '[url]' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.",
        "status": "Failed",
        "severity": "Moderate",
        "assessmentName": "cors_violation"
    },
    {
        "resource": "[url]",
        "resolutionStatus": "blocked",
        "message": "Access to font at '[url]' from origin '[url]' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.",
        "status": "Failed",
        "severity": "Moderate",
        "assessmentName": "cors_violation"
    }
]

Security Misconfiguration: Overly Permissive CORS Whitelist

Field		Description
diligence_annotations Array		List of all evidence associated with the assessment.

	assessmentName String	Name of the assessment that this evidence is associated to. For this type, the name will always be `directory_listing_exposure`.
	status String	Test result associated to this evidence. Either Pass or Failed.
	severity String	Severity associated to this evidence.
	header String	Name of the HTTP header.
	value String	Value of the HTTP header.

[
    {
        "name": "Access-Control-Allow-Origin",
        "value": "*",
        "status": "Failed",
        "severity": "Moderate",
        "assessmentName": "permissive_cors_whitelist"
    }
]

Security Misconfiguration: HTTPS to HTTP Redirects

Field			Description
diligence_annotations Array			List of all evidence associated with the assessment.

	assessmentName String		Name of the assessment that this evidence is associated to. For this type, the name will always be `https_to_http_redirect`.
	status String		Test result associated to this evidence. Either Pass or Failed.
	severity String		Severity associated to this evidence.
	value String		Element in the redirect chain that caused the downgrade
	responseChain Array		Full response chain that was followed when loading the domain.

		url String [URL]	URL that was followed on a specific step of the response chain.
		statusCode Integer	HTTP status code for the redirect.
		ip String [IP]	IP of the URL that was followed.
		port Integer	Port that was used to connect on the specific step of the response chain.

[
    {
        "value": "http://[url_3]",
        "responseChain": [
            {
                "url": "http://[url_1]",
                "statusCode": 301,
                "ip": "[ip]",
                "port": 80
            },
            {
                "url": "https://[url_2]",
                "statusCode": 302,
                "ip": "[ip]",
                "port": 443
            },
            {
                "url": "http://[url_3]",
                "statusCode": 301,
                "ip": "[ip]",
                "port": 80
            },
            {
                "url": "https://[url_4]",
                "statusCode": 200,
                "ip": "[ip]",
                "port": 443
            }
        ],
        "status": "Failed",
        "severity": "Material",
        "assessmentName": "https_to_http_redirect"
    }
]

Articles in this section