5

I tested my app with BURP scan tool.It shows me some informational issues having confidence level of 'Firm' and 'Certain'.It has no Low,Medium and High Issues.So what I want whether is it good enough for the report to be uploaded for security review or should I fix these issues and then upload it for security review.

I also want to know what are these 'High','Medium','Low' and 'Informational' issues and the confidence level 'Certain','Firm','Tentative'.Also let me know which issues are rejected by security review,is it 'High' only? or 'Medium'/'low' issues are also rejected by security review.

6

You can generally ignore informational BURP issues. The TE team should have a list of which BURP issues can be ignored and which need to be addressed.

The following issues can be ignored, modulo caveats in comments:

  • Informational issues about crossdomain.xml files/silverlight cross domain sharing or use of HTML 5 CORS. As long as the file/header is not wildcarded you should be OK.

  • Information about the existence of file uploads. You need to be sure that you do not allow arbitrary file extensions or allow the user to specify paths, but allowing file uploads in principle is fine.

  • Referer-dependent response

  • X-Forwarded-For dependent response

  • User agent-dependent response

  • Password field submitted using GET method

  • Password returned in URL query string

  • SQL statement in request parameter

  • Cross-domain POST

  • Long redirection response

  • Serialized object in HTTP message

  • Cookie scoped to parent domain -- bad practice but not grounds for failure as this is often the case with tracking/non-session cookies.

  • Cross-domain script include -- again, this is common with tracking/analytics code

  • Cookie without HttpOnly flag set -- Salesforce does not require HttpOnly, nor does Salesforce use HttpOnly for session ids.

  • Session token in URL -- You should try to not do this because of referal leakage and server side logging but in some cases this is necessary.

  • Password field with autocomplete enabled

  • Frameable response (potential Clickjacking) -- you should have X-Frames options but in some cases sights need to be framed.

  • Browser cross-site scripting filter disabled -- not grounds for failure, but please don't do this.

Additionally, you can ignore the 'manipulation' issues:

  • Cookie manipulation (DOM-based)
  • Ajax request header manipulation (DOM-based)
  • HTML5 web message manipulation (DOM-based)
  • HTML5 storage manipulation (DOM-based)
  • Link manipulation (DOM-based)
  • Document domain manipulation (DOM-based)
  • DOM data manipulation (DOM-based)

The following can also be ignored:

  • Email addresses disclosed
  • Private IP addresses disclosed

  • Robots.txt file

  • Cacheable HTTPS response -- it's preferably to not cache HTTPS responses but this is not grounds for failure.

  • Base64-encoded data in parameter

  • Multiple content types specified

  • HTML does not specify charset -- please fix but not grounds for failure

  • HTML uses unrecognized charset
  • Content type incorrectly stated -- only an issue if you are returning JSON but specifying it as HTML.
  • Content type is not specified -- please fix this, but not grounds for failure.
  • SSL certificate -- fine as long as it is valid. OK to have a bad cert in staging as long as production cert is valid.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.