Summary

Acunetix 360 detected that weak ciphers are enabled during secure communication (SSL).

You should allow only strong ciphers on your web server to protect secure communication with your visitors. However, it is possible that the reported weak ciphers are not a concern in your specific environment due to factors such as serverless architectures, managed services, or cloud-provider-controlled configurations that do not allow modification of cipher settings. 

Impact

Attackers might decrypt SSL traffic between your server and your visitors.

Actions To Take

If your environment is serverless or managed by a cloud provider, you may consider marking this vulnerability as a Accepted Risk.

If further validation is needed, ensure that your web server configuration is reviewed and that only strong ciphers are enabled. Follow the configuration steps below to secure your communication.

  1. For Apache, you should modify the SSLCipherSuite directive in the httpd.conf. 
    SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4
  2. Lighttpd: 
    ssl.honor-cipher-order = "enable"
ssl.cipher-list = "EECDH+AESGCM:EDH+AESGCM"
  3. For Microsoft IIS, you should make some changes to the system registry. Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on your computer.

    a. Click Start, click Run, type regedt32 or type regedit, and then click OK.
    b. In Registry Editor, locate the following registry key: HKLMSYSTEMCurrentControlSetControlSecurityProviders
    c. Set "Enabled" DWORD to "0x0" for the following registry keys:
     
    SCHANNELCiphersDES 56/56
    SCHANNELCiphersRC4 64/128
    SCHANNELCiphersRC4 40/128
    SCHANNELCiphersRC2 56/128
    SCHANNELCiphersRC2 40/128
    SCHANNELCiphersNULL 
    SCHANNELHashesMD5
    You may also use the Disable-TlsCipherSuite powershell command to disable certain ciphers. 
    Disable-TlsCipherSuite -Name "TLS_RSA_WITH_AES_256_CBC_SHA"
    To get a formatted list of ciphers, you can use the following command. 
    Get-TlsCipherSuite | Format-Table Name

Remediation

Configure your web server to disallow using weak ciphers. Please consider following when selecting ciphers:
  • Use at least 128 bit of encryption
  • Anonymous Diffie-Hellman (ADH) suites do not provide authentication.
  • Using CBC ciphers, Export ciphers, NULL cipher suites is insecure.
  • RC4 is insecure.

Severity

Medium

Classification

PCI v3.2-6.5.4 CAPEC-217 CWE-327 ISO27001-A.14.1.3 WASC-4 OWASP 2013-A6 OWASP 2017-A3 CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N