CWE-1428: Reliance on HTTP instead of HTTPS

What is Reliance on HTTP instead of HTTPS?

• Overview: Reliance on HTTP instead of HTTPS is a vulnerability where a software product uses HTTP for communications even though HTTPS, which provides encryption, is available. This exposes data to interception and manipulation, compromising confidentiality, integrity, and authenticity.

• Exploitation Methods:

• Attackers can intercept HTTP traffic using man-in-the-middle (MITM) attacks.
• Common attack patterns include eavesdropping on unencrypted data and session hijacking.

• Security Impact:

• Direct consequences include data theft, unauthorized data access, and tampering with data in transit.
• Potential cascading effects include broader system compromise through session hijacking and credential theft.
• Business impact includes loss of customer trust, data breaches, and potential regulatory fines.

• Prevention Guidelines:

• Specific code-level fixes include configuring servers to redirect HTTP traffic to HTTPS.
• Security best practices involve enforcing HTTPS for all communications and using HSTS (HTTP Strict Transport Security).
• Recommended tools and frameworks include using TLS libraries and frameworks that automatically enforce HTTPS, such as Let's Encrypt for obtaining and renewing certificates.

Corgea can automatically detect and fix Reliance on HTTP instead of HTTPS in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: Not Language-Specific

Affected Technologies: Not Technology-Specific

Vulnerable Code Example

Certainly! Let's improve the code examples for CWE-1428 (Reliance on HTTP instead of HTTPS) by addressing the issues you mentioned.

const http = require('http');

function fetchData(apiUrl) {
    // Using HTTP exposes data to interception and tampering
    http.get(`http://\${apiUrl}/data`, (response) => {
        let data = '';
        response.on('data', (chunk) => {
            data += chunk;
        });
        response.on('end', () => {
            try {
                console.log(JSON.parse(data));  // Potentially unsafe if data is tampered
            } catch (e) {
                console.error('Failed to parse response data:', e);
            }
        });
    }).on('error', (e) => {
        console.error(`Got error: \${e.message}`);
    });
}

How to fix Reliance on HTTP instead of HTTPS?

The use of HTTP for server communication is insecure because it allows data to be intercepted and tampered with by attackers. Switching to HTTPS encrypts the data in transit, ensuring its confidentiality and integrity.

Fix Approach:

1. Switch to HTTPS: Use HTTPS for secure communication.
2. Error Handling: Implement robust error handling for HTTPS connection issues.
3. Certificate Verification: Ensure that the server's SSL certificate is valid and verified.

Fixed Code Example

const https = require('https');

function fetchData(apiUrl) {
    // Using HTTPS ensures data is encrypted and secure from interception
    https.get(`https://\${apiUrl}/data`, (response) => {
        let data = '';
        response.on('data', (chunk) => {
            data += chunk;
        });
        response.on('end', () => {
            try {
                console.log(JSON.parse(data));  // Safely parse the secure data
            } catch (e) {
                console.error('Failed to parse response data:', e);
            }
        });
    }).on('error', (e) => {
        console.error(`Got error: \${e.message}`);  // Handle HTTPS errors
    });
}

Explanation:

• HTTP vs. HTTPS: The vulnerable example uses HTTP, which is not secure. The fixed example uses HTTPS, which encrypts the data, protecting it from eavesdropping and tampering.
• Error Handling: Both examples include basic error handling, but the fixed example emphasizes the importance of handling HTTPS-specific errors.
• Data Integrity: By using HTTPS, the integrity and confidentiality of the data are maintained, preventing potential Man-in-the-Middle (MITM) attacks.

The changes ensure the examples clearly demonstrate the vulnerability and its fix, while following best practices for JavaScript.