May 11, 2024
Vulnerability Scan
Report
prepared by
HostedScan Security
hostedscan.com
HostedScan Security Vulnerability Scan Report
Overview
1 Executive Summary 3
2 Vulnerabilities By Target 4
3 Passive Web Application Vulnerabilities 6
4 Glossary 14
hostedscan.com 2
Executive Summary Vulnerability Scan Report
1 Executive Summary
Vulnerability scans were conducted on select servers, networks, websites, and applications. This report contains the
discovered potential vulnerabilities from these scans. Vulnerabilities have been classified by severity. Higher severity
indicates a greater risk of a data breach, loss of integrity, or availability of the targets.
1.1 Total Vulnerabilities
Below are the total number of vulnerabilities found by severity. Critical vulnerabilities are the most severe and should
be evaluated first. An accepted vulnerability is one which has been manually reviewed and classified as acceptable
to not fix at this time, such as a false positive detection or an intentional part of the system's architecture.
Critical High Medium Low Accepted
0 0 4 2 0
67% 33%
1.2 Report Coverage
This report includes findings for 1 target scanned. Each target is a single URL, IP address, or fully qualified domain
name (FQDN).
Vulnerability Categories
6
Passive Web Application Vulnerabilities
hostedscan.com 3
Vulnerabilities By Target Vulnerability Scan Report
2 Vulnerabilities By Target
This section contains the vulnerability findings for each scanned target. Prioritization should be given to the
targets with the highest severity vulnerabilities. However, it is important to take into account the purpose of each
system and consider the potential impact a breach or an outage would have for the particular target.
2.1 Targets Summary
The number of potential vulnerabilities found for each target by severity.
Target Critical High Medium Low Accepted
https://www.rotativodemexico.com/ 0 0 4 2 0
hostedscan.com 4
Vulnerabilities By Target | https://www.rotativodemexico.com/ Vulnerability Scan Report
2.2 Target Breakdowns
Details for the potential vulnerabilities found for each target by scan type.
https://www.rotativodemexico.com/
Target
Total Risks
0 0 4 2 0
67% 33%
Passive Web Application Vulnerabilities Severity First Detected Last Detected
Absence of Anti-CSRF Tokens Medium 0 days ago 0 days ago
CSP: Wildcard Directive Medium 0 days ago 0 days ago
CSP: script-src unsafe-inline Medium 0 days ago 0 days ago
CSP: style-src unsafe-inline Medium 0 days ago 0 days ago
Cross-Domain JavaScript Source File Low 0 days ago 0 days ago
Inclusion
Strict-Transport-Security Header Not Set Low 0 days ago 0 days ago
hostedscan.com 5
Passive Web Application Vulnerabilities Vulnerability Scan Report
3 Passive Web Application Vulnerabilities
The OWASP ZAP Passive Web Application scan crawls the pages of a website or web application. The passive scan
inspects each page as well as the requests and responses sent between the server. The passive scan checks for
vulnerabilities such as cross-domain misconfigurations, insecure cookies, vulnerable Javascript dependencies, and
more.
3.1 Total Vulnerabilities
Total number of vulnerabilities found by severity.
Critical High Medium Low Accepted
0 0 4 2 0
67% 33%
3.2 Vulnerabilities Breakdown
Summary list of all detected vulnerabilities.
Title Severity Open Accepted
Absence of Anti-CSRF Tokens Medium 1 0
CSP: Wildcard Directive Medium 1 0
CSP: script-src unsafe-inline Medium 1 0
CSP: style-src unsafe-inline Medium 1 0
Cross-Domain JavaScript Source File Inclusion Low 1 0
Strict-Transport-Security Header Not Set Low 1 0
hostedscan.com 6
Passive Web Application Vulnerabilities | Absence of Anti-CSRF Tokens Vulnerability Scan Report
3.3 Vulnerability Details
Detailed information about each potential vulnerability found by the scan.
Absence of Anti-CSRF Tokens
SEVERITY AFFECTED TARGETS LAST DETECTED
Medium 1 target 0 days ago
Description
No Anti-CSRF tokens were found in a HTML submission form.
A cross-site request forgery is an attack that involves forcing a victim to send an HTTP request to a target destination without their
knowledge or intent in order to perform an action as the victim. The underlying cause is application functionality using predictable
URL/form actions in a repeatable way. The nature of the attack is that CSRF exploits the trust that a web site has for a user. By contrast,
cross-site scripting (XSS) exploits the trust that a user has for a web site. Like XSS, CSRF attacks are not necessarily cross-site, but they
can be. Cross-site request forgery is also known as CSRF, XSRF, one-click attack, session riding, confused deputy, and sea surf.
CSRF attacks are effective in a number of situations, including:
* The victim has an active session on the target site.
* The victim is authenticated via HTTP auth on the target site.
* The victim is on the same local network as the target site.
CSRF has primarily been used to perform an action against a target site using the victim's privileges, but recent techniques have been
discovered to disclose information by gaining access to the response. The risk of information disclosure is dramatically increased when
the target site is vulnerable to XSS, because XSS can be used as a platform for CSRF, allowing the attack to operate within the bounds of
the same-origin policy.
Solution
Phase: Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to
avoid.
For example, use anti-CSRF packages such as the OWASP CSRFGuard.
Phase: Implementation
Ensure that your application is free of cross-site scripting issues, because most CSRF defenses can be bypassed using attacker-
controlled script.
Phase: Architecture and Design
Generate a unique nonce for each form, place the nonce into the form, and verify the nonce upon receipt of the form. Be sure that the
nonce is not predictable (CWE-330).
Note that this can be bypassed using XSS.
Identify especially dangerous operations. When the user performs a dangerous operation, send a separate confirmation request to
ensure that the user intended to perform that operation.
hostedscan.com 7
Passive Web Application Vulnerabilities | Absence of Anti-CSRF Tokens Vulnerability Scan Report
Note that this can be bypassed using XSS.
Use the ESAPI Session Management control.
This control includes a component for CSRF.
Do not use the GET method for any request that triggers a state change.
Phase: Implementation
Check the HTTP Referer header to see if the request originated from an expected page. This could break legitimate functionality,
because users or proxies may have disabled sending the Referer for privacy reasons.
Instances (1 of 100)
uri: https://www.rotativodemexico.com/cadena-azul-radio/
method: GET
evidence: <form method="get" class="td-search-form" action="https://www.rotativodemexico.com/">
otherinfo: No known Anti-CSRF token [anticsrf, CSRFToken, __RequestVerificationToken, csrfmiddlewaretoken, authenticity_token,
OWASP_CSRFTOKEN, anoncsrf, csrf_token, _csrf, _csrfSecret, __csrf_magic, CSRF, _token, _csrf_token, data[_Token][key]] was found in the
following HTML form: [Form 1: "td-header-search-mob" ].
References
https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
https://cwe.mitre.org/data/definitions/352.html
Vulnerable Target First Detected Last Detected
https://www.rotativodemexico.com/ 0 days ago 0 days ago
hostedscan.com 8
Passive Web Application Vulnerabilities | CSP: Wildcard Directive Vulnerability Scan Report
CSP: Wildcard Directive
SEVERITY AFFECTED TARGETS LAST DETECTED
Medium 1 target 0 days ago
Description
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not
limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement
or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of
content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and
embeddable objects such as Java applets, ActiveX, audio and video files.
Solution
Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
Instances (1 of 35)
uri: https://www.rotativodemexico.com/
method: GET
param: Content-Security-Policy
evidence: upgrade-insecure-requests;
otherinfo: The following directives either allow wildcard sources (or ancestors), are not defined, or are overly broadly defined: script-src, style-
src, img-src, connect-src, frame-src, frame-ancestors, font-src, media-src, object-src, manifest-src, worker-src, form-action The directive(s):
frame-ancestors, form-action are among the directives that do not fallback to default-src, missing/excluding them is the same as allowing
anything.
References
https://www.w3.org/TR/CSP/
https://caniuse.com/#search=content+security+policy
https://content-security-policy.com/
https://github.com/HtmlUnit/htmlunit-csp
https://developers.google.com/web/fundamentals/security/csp#policy_applies_to_a_wide_variety_of_resources
Vulnerable Target First Detected Last Detected
https://www.rotativodemexico.com/ 0 days ago 0 days ago
hostedscan.com 9
Passive Web Application Vulnerabilities | CSP: script-src unsafe-inline Vulnerability Scan Report
CSP: script-src unsafe-inline
SEVERITY AFFECTED TARGETS LAST DETECTED
Medium 1 target 0 days ago
Description
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not
limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement
or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of
content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and
embeddable objects such as Java applets, ActiveX, audio and video files.
Solution
Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
Instances (1 of 35)
uri: https://www.rotativodemexico.com/
method: GET
param: Content-Security-Policy
evidence: upgrade-insecure-requests;
otherinfo: script-src includes unsafe-inline.
References
https://www.w3.org/TR/CSP/
https://caniuse.com/#search=content+security+policy
https://content-security-policy.com/
https://github.com/HtmlUnit/htmlunit-csp
https://developers.google.com/web/fundamentals/security/csp#policy_applies_to_a_wide_variety_of_resources
Vulnerable Target First Detected Last Detected
https://www.rotativodemexico.com/ 0 days ago 0 days ago
hostedscan.com 10
Passive Web Application Vulnerabilities | CSP: style-src unsafe-inline Vulnerability Scan Report
CSP: style-src unsafe-inline
SEVERITY AFFECTED TARGETS LAST DETECTED
Medium 1 target 0 days ago
Description
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. Including (but not
limited to) Cross Site Scripting (XSS), and data injection attacks. These attacks are used for everything from data theft to site defacement
or distribution of malware. CSP provides a set of standard HTTP headers that allow website owners to declare approved sources of
content that browsers should be allowed to load on that page — covered types are JavaScript, CSS, HTML frames, fonts, images and
embeddable objects such as Java applets, ActiveX, audio and video files.
Solution
Ensure that your web server, application server, load balancer, etc. is properly configured to set the Content-Security-Policy header.
Instances (1 of 35)
uri: https://www.rotativodemexico.com/
method: GET
param: Content-Security-Policy
evidence: upgrade-insecure-requests;
otherinfo: style-src includes unsafe-inline.
References
https://www.w3.org/TR/CSP/
https://caniuse.com/#search=content+security+policy
https://content-security-policy.com/
https://github.com/HtmlUnit/htmlunit-csp
https://developers.google.com/web/fundamentals/security/csp#policy_applies_to_a_wide_variety_of_resources
Vulnerable Target First Detected Last Detected
https://www.rotativodemexico.com/ 0 days ago 0 days ago
hostedscan.com 11
Passive Web Application Vulnerabilities | Cross-Domain JavaScript Source File Inclusion Vulnerability Scan Report
Cross-Domain JavaScript Source File Inclusion
SEVERITY AFFECTED TARGETS LAST DETECTED
Low 1 target 0 days ago
Description
The page includes one or more script files from a third-party domain.
Solution
Ensure JavaScript source files are loaded from only trusted sources, and the sources can't be controlled by end users of the application.
Instances (1 of 89)
uri: https://www.rotativodemexico.com/category/general/
method: GET
param: //pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
evidence: <script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
Vulnerable Target First Detected Last Detected
https://www.rotativodemexico.com/ 0 days ago 0 days ago
hostedscan.com 12
Passive Web Application Vulnerabilities | Strict-Transport-Security Header Not Set Vulnerability Scan Report
Strict-Transport-Security Header Not Set
SEVERITY AFFECTED TARGETS LAST DETECTED
Low 1 target 0 days ago
Description
HTTP Strict Transport Security (HSTS) is a web security policy mechanism whereby a web server declares that complying user agents
(such as a web browser) are to interact with it using only secure HTTPS connections (i.e. HTTP layered over TLS/SSL). HSTS is an IETF
standards track protocol and is specified in RFC 6797.
Solution
Ensure that your web server, application server, load balancer, etc. is configured to enforce Strict-Transport-Security.
Instances (1 of 100)
uri: https://www.rotativodemexico.com/
method: GET
References
https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html
https://owasp.org/www-community/Security_Headers
https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
https://caniuse.com/stricttransportsecurity
https://datatracker.ietf.org/doc/html/rfc6797
Vulnerable Target First Detected Last Detected
https://www.rotativodemexico.com/ 0 days ago 0 days ago
hostedscan.com 13
Glossary Vulnerability Scan Report
4 Glossary
Accepted Vulnerability Vulnerability
An accepted vulnerability is one which has been manually A weakness in the computational logic (e.g., code) found
reviewed and classified as acceptable to not fix at this in software and hardware components that, when
time, such as a false positive scan result or an intentional exploited, results in a negative impact to confidentiality,
part of the system's architecture. integrity, or availability. Mitigation of the vulnerabilities in
this context typically involves coding changes, but could
Fully Qualified Domain Name (FQDN) also include specification changes or even specification
deprecations (e.g., removal of affected protocols or
A fully qualified domain name is a complete domain name
functionality in their entirety).
for a specific website or service on the internet. This
includes not only the website or service name, but also the
Target
top-level domain name, such as .com, .org, .net, etc. For
example, 'www.example.com' is an FQDN. A target represents target is a single URL, IP address, or
fully qualified domain name (FQDN) that was scanned.
Passive Web Application Vulnerabilities
Severity
The OWASP ZAP Passive Web Application scan crawls the
pages of a website or web application. The passive scan Severity represents the estimated impact potential of a
inspects each page as well as the requests and responses particular vulnerability. Severity is divided into 5
sent between the server. The passive scan checks for categories: Critical, High, Medium, Low and Accepted.
vulnerabilities such as cross-domain misconfigurations,
insecure cookies, vulnerable Javascript dependencies, CVSS Score
and more. The CVSS 3.0 score is a global standard for evaluating
vulnerabilities with a 0 to 10 scale. CVSS maps to threat
levels:
0.1 - 3.9 = Low
4.0 - 6.9 = Medium
7.0 - 8.9 = High
9.0 - 10.0 = Critical
hostedscan.com 14
This report was prepared using
HostedScan Security ®
For more information, visit hostedscan.com
Founded in Seattle, Washington in 2019, HostedScan, LLC. is
dedicated to making continuous vulnerability scanning and risk
management much more easily accessible to more businesses.
HostedScan, LLC.
2212 Queen Anne Ave N
Suite #521 Terms & Policies
Seattle, WA 98109 hello@hostedscan.com
hostedscan.com 15
