Missing header Security Vulnerability

During QUALYS Web Application Scanning of User System – Oracle Fusion (Integration layer), if one is facing the below security vulnerabilities, then follow the steps mentioned in the solution.

Vulnerability 1:

ID and Name

150202 and Missing header: X-Content-Type-Options

Threat

The X-Content-Type-Options response header is not present. WAS reports missing X-Content-Type-Options header on each crawled link with all types of static and dynamic response. The scanner performs the check on 4xx and 5xx responses too. It’s possible to see a directory link reported for QID as well.

Impact

All web browsers employ a content-sniffing algorithm that inspects the contents of HTTP responses and also occasionally overrides the MIME type provided by the server. If the X-Content-Type-Options header is not present, browsers can potentially be tricked into treating non-HTML responses as HTML. An attacker can potentially leverage the functionality to perform a cross-site scripting (XSS) attack. This specific case is known as a Content-Sniffing XSS (CS-XSS) attack.

Vulnerability 2:

ID and Name

150204 and Missing header: X-XSS-Protection

Threat

The X-XSS-Protection response header is not present.

Impact

The X-XSS-Protection response header provides a layer of protection against reflected cross-site scripting (XSS) attacks by instructing browsers to abort rendering a page in which a reflected XSS attack has been detected. This is a best-effort second line of defense measure which helps prevent an attacker from using evasion techniques to avoid the neutralization mechanisms that the filters use by default. When configured appropriately, browser-level XSS filters can provide additional layers of defense against web application attacks. Note that HTTP 4xx and 5xx responses can also be susceptible to attacks such as XSS. For better security, the X-XSS-Protection header should be set on 4xx and 5xx responses as well.

Solution

• Stop the OHS

/<Environment_Name>/products/user_projects/domains/<Domain_Name>/bin/stopComponent.sh <OHS_Name>

• Take a backup of httpd.conf kept on below location

/<Environment_Name>/products/instances/<OHS_Folder_Name>/config/OHS/<OHS_Name>

• Modify the httpd.conf by adding the following block:

• Start the OHS

/<Environment_Name>/products/user_projects/domains/<Domain_Name>/bin/startComponent.sh <OHS_Name>

NOTE: Please perform above solution steps on each OHS servers.