Directory listing enabled on /assets

lowInformation Disclosure조치 완료

설명

The primary web endpoint still accepts TLS 1.0 connections, which are vulnerable to BEAST, POODLE, and other known attacks. TLS 1.0 was deprecated by RFC 8996 in March 2021.

영향 범위: All traffic to safeintel.io on port 443

기술적 상세

Handshake negotiation succeeds with TLSv1.0 using cipher suite TLS_RSA_WITH_AES_128_CBC_SHA. Server does not enforce minimum protocol version.

증거

$ openssl s_client -connect safeintel.io:443 -tls1
CONNECTED(00000003)
Protocol  : TLSv1
Cipher    : AES128-SHA
Nmap scan: 443/tcp open ssl/http
| ssl-enum-ciphers:
|   TLSv1.0:
|     ciphers:
|       TLS_RSA_WITH_AES_128_CBC_SHA

권장 조치 사항

  1. 1

    Disable TLS 1.0 and 1.1 in the web server configuration. Set minimum protocol to TLS 1.2.

  2. 2

    Remove weak cipher suites (RC4, DES, 3DES) and prefer AEAD ciphers (AES-GCM, ChaCha20-Poly1305).

  3. 3

    Enable HSTS with includeSubDomains to prevent protocol downgrade attacks.

상태 변경