[Web][Audit] Admin L3 Feedback

[karntrehan]

Report: Web Application Security Audit Report of Samagra Shiksha Level 3.pdf

[yuvrajsab]

Todo:

• [L] HTTP Security Headers Not Implemented - It was observed that security headers such as X-XSS protection, Content Security Policy, Strict Transport security policy, X-Content- Type-Options were not implemented in remote application. - @yuvrajsab
• [L] Server version disclosure - remove server name from the HTTP response throughout the app.

To Evaluate:

• [L] Web Server Information Disclosure - Application is displaying Server version and Next.Js version and Nginx Version which may help attacker to learn more about his target. - @amit-s19 @yuvrajsab

Not needed:

• [M] CAPTCHA not Implemented - Not a valid usecase
• [M] Password Recovery Process is not working - It was observed that Password Recovery Functionality was not implemented - This is not a valid usecase for us.
• [L] Change password module is not implemented. - Not a valid usecase. (Only Admin can reset the password for a user).

[choxx]

Netgen servers are not accessible. Issue raised, 3 out of 5 nodes are UP. Services are still not accessible to continue working further.