Executive Summary
During the security assessment, it was identified that the application does not enforce HTTP Strict Transport Security (HSTS). As a result, browsers are not instructed to communicate exclusively over HTTPS, exposing users to downgrade attacks such as SSL Stripping. This weakness may allow an attacker positioned on the network to intercept or manipulate sensitive communications before a secure HTTPS connection is established.
Vulnerability
Title: HTTP Strict Transport Security (HSTS) Not Enforced
Severity: Medium
Technical Description
The application does not return the Strict-Transport-Security response header. Without HSTS, browsers may initially access the website over HTTP or accept downgraded HTTP connections, making users vulnerable to SSL stripping attacks.
An attacker capable of intercepting network traffic can exploit this weakness by rewriting HTTPS requests into HTTP, preventing the establishment of an encrypted TLS session. This allows the attacker to observe, intercept, or modify transmitted data.
Steps to Reproduce
Visit https:
Scan the target website https:
Observe that the Strict-Transport-Security header is missing.
Verify that the domain is not enforcing HSTS protection.
Proof of Concept
The security assessment confirmed that the server does not include the following response header:
Strict-Transport-Security
As a result, browsers are not instructed to access the application exclusively via HTTPS.
Attack Scenario
An attacker connected to the same network as a victim (for example, on public Wi-Fi or another compromised network) intercepts the victim's traffic.
The attacker performs an SSL stripping attack using tools such as sslstrip, downgrading HTTPS requests to HTTP before the browser establishes a secure connection.
Since HSTS is not enabled, the victim's browser accepts the insecure connection without warning. The attacker can then:
Intercept authentication credentials.
Capture session cookies.
Read sensitive user information.
Modify responses returned to the victim.
Inject malicious content or phishing pages.
User Impact
Exposure of sensitive user information.
Increased risk of credential theft.
Session hijacking opportunities.
Loss of confidentiality and integrity of transmitted data.
Reduced user trust in the platform's security.
Business Impact
Increased likelihood of account compromise.
Exposure of confidential business and customer data.
Regulatory and compliance concerns.
Reputational damage resulting from successful interception attacks.
Increased security and incident response costs following exploitation.
Remediation
Enable HTTP Strict Transport Security (HSTS) by configuring the web server to return the following response header:
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Recommendations:
Redirect all HTTP traffic to HTTPS.
Enable HSTS with an appropriate max-age value.
Include the includeSubDomains directive where applicable.
Consider adding the preload directive and submitting the domain to the HSTS preload list after verifying HTTPS support across all subdomains.
Perform periodic security reviews to ensure HSTS remains correctly configured.