CWE-1428 is a product that provides or relies on HTTP communications when HTTPS is available.
That describes a large share of the web: older services, internal tools, API clients with hard coded URLs, and pages that load one image over http.
How it happens
HTTP is not encrypted, so it is open to attacks on confidentiality, integrity and authenticity. Unlike many protocols, HTTPS is a widely available alternative that does use encryption, so staying on HTTP is usually a choice or an oversight.
Typical causes:
- a server that answers on port 80 and never redirects
- an app or client configured with an http URL
- mixed content, an HTTPS page that includes elements loaded from http URLs, often images or other resources that seem harmless
What an attacker gains
MITRE lists confidentiality and integrity, with high likelihood. Attackers can read cleartext packets, modify sessions, and compromise servers or clients through cache poisoning, phishing and similar attacks.
How to find it
The record lists no detection methods. Request each of your hostnames over http and see whether you get content or a redirect. Search code and config for http URLs, and look in the browser console for mixed content warnings.
How to fix it
MITRE's mitigations:
- Require HTTPS or another mechanism that encrypts communication, explicitly.
- Avoid mixed content. Do not include http resources in HTTPS pages.
- Force HTTPS by redirecting HTTP requests.
- Remove unencrypted protocols where a product supports several.
A redirect in nginx looks like this.
server {
listen 80;
server_name example.com;
return 301 https://$host$request_uri;
}
Quick check
Is one http image on an HTTPS page a real problem?
MITRE lists mixed content as something to avoid, even for resources that seem to have no privacy or security implications.
