Vulnerability Scan Result
| Title: | 【アスクル】アウトレット通販 事務用品/文房具などが安い！新着おすすめコーナー - 最大80%OFFセール中！ASKUL（公式） |
| Description: | 文房具や日用品、生活雑貨などがアウトレット 30～80%OFFなどで続々入荷！仕事場で役立ついろいろなアイテムがセール価格でお買い求めいただけます。最短当日または翌日以降お届け。【法人は2000円（税込）以上配送料当社負担！※配送料・お届けは条件にて異なります】【カード決済可】【返品OK】-法人も個人事業主さまも、はたらくすべての方に便利でお得な商品やサービスをお届けする通販サイト、ASKULです。 |
| IP address | 210.152.119.120 |
| Country | JP  |
| AS number | AS4694 |
| Net name | IDC Frontier Inc |
25/tcp | smtp | BorderWare firewall smtpd |
80/tcp | http | Apache httpd |
443/tcp | https | Apache httpd |
| Software / Version | Category |
|---|---|
| Microsoft Advertising | Advertising |
| Microsoft Clarity 0.7.63 | Analytics |
| Contentsquare | Analytics, A/B Testing |
| Criteo | Advertising, Retargeting |
| Adobe Experience Platform Identity Service | Customer data platform |
| Adobe Experience Platform Launch | Tag managers |
| Facebook Pixel 2.9.180 | Analytics |
| jQuery-pjax | Mobile frameworks |
| jQuery Migrate 3.4.0 | JavaScript libraries |
| core-js 3.32.2 | JavaScript libraries |
| Google Analytics | Analytics |
| Apache HTTP Server | Web servers |
| Java | Programming languages |
| jQuery 3.6.0 | JavaScript libraries |
| jQuery UI 1.8.1 | JavaScript libraries |
| RichRelevance \1 | Personalisation |
| Adobe Analytics | Analytics |
| Yahoo Advertising | Advertising, Retargeting |
| Google Tag Manager | Tag managers |
| HSTS | Security |
| JSP | Web frameworks |
| Cart Functionality | Ecommerce |
Web Application Vulnerabilities
Evidence
| URL | Cookie Name | Evidence |
|---|---|---|
| https://www.askul.co.jp/ol/0/ | BROWSER_ID, C3VALUE, SEGMENT_ID, NOT_MEMBER, UserTracking | The server responded with Set-Cookie header(s) that does not specify the HttpOnly flag: Set-Cookie: BROWSER_ID=845ec98b-371c-413a-859e-8595283cab82 Set-Cookie: C3VALUE=10bb30f04dedaa4c3f64c33b2903f4484e132eaeccdef4aa3888635f472adea6 Set-Cookie: SEGMENT_ID=651 Set-Cookie: NOT_MEMBER=1 Set-Cookie: UserTracking=4881c906.62c3196cd655c |
Vulnerability description
We found that a cookie has been set without the <code>HttpOnly</code> flag, which means it can be accessed by potentially malicious JavaScript code running inside the web page. The root cause for this usually revolves around misconfigurations in the code or server settings.
Recommendation
Ensure that the HttpOnly flag is set for all cookies.
Classification
| CWE | CWE-1004 |
| OWASP Top 10 - 2017 | A6 - Security Misconfiguration |
| OWASP Top 10 - 2021 | A5 - Security Misconfiguration |
Evidence
| URL | Cookie Name | Evidence |
|---|---|---|
| https://www.askul.co.jp/ol/0/ | www-affinity | Set-Cookie: www-affinity=0297e3408bcef04ef228a26c0b4cc93e |
Vulnerability description
We found that a cookie has been set without the <code>Secure</code> flag, which means the browser will send it over an unencrypted channel (plain HTTP) if such a request is made. The root cause for this usually revolves around misconfigurations in the code or server settings.
Recommendation
Whenever a cookie contains sensitive information or is a session token, then it should always be passed using an encrypted channel. Ensure that the secure flag is set for cookies containing such sensitive information.
Classification
| CWE | CWE-614 |
| OWASP Top 10 - 2017 | A6 - Security Misconfiguration |
| OWASP Top 10 - 2021 | A5 - Security Misconfiguration |
Evidence
| Risk Level | CVSS | CVE | Summary | Affected software |
|---|---|---|---|---|
| 6.1 | CVE-2022-31160 | jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. Calling `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities will make them erroneously get decoded. This can lead to potentially executing JavaScript code. The bug has been patched in jQuery UI 1.13.2. To remediate the issue, someone who can change the initial HTML can wrap all the non-input contents of the `label` in a `span`. | jquery_ui 1.8.1 | |
| 4.3 | CVE-2010-5312 | Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option. | jquery_ui 1.8.1 | |
| 4.3 | CVE-2021-41182 | jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources. | jquery_ui 1.8.1 | |
| 4.3 | CVE-2021-41183 | jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML. A workaround is to not accept the value of the `*Text` options from untrusted sources. | jquery_ui 1.8.1 | |
| 4.3 | CVE-2021-41184 | jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources. | jquery_ui 1.8.1 |
Vulnerability description
We noticed known vulnerabilities in the target application based on the server responses. They are usually related to outdated systems and expose the affected applications to the risk of unauthorized access to confidential data and possibly denial of service attacks. Depending on the system distribution the affected software can be patched but displays the same version, requiring manual checking.
Recommendation
In order to eliminate the risk of these vulnerabilities, we recommend you check the installed software version and upgrade to the latest version.
Classification
| CWE | CWE-1026 |
| OWASP Top 10 - 2017 | A9 - Using Components with Known Vulnerabilities |
| OWASP Top 10 - 2021 | A6 - Vulnerable and Outdated Components |
Evidence
| URL | Evidence |
|---|---|
| https://www.askul.co.jp/ol/0/ | Response does not include the HTTP Content-Security-Policy security header or meta tag |
Vulnerability description
We noticed that the target application lacks the Content-Security-Policy (CSP) header in its HTTP responses. The CSP header is a security measure that instructs web browsers to enforce specific security rules, effectively preventing the exploitation of Cross-Site Scripting (XSS) vulnerabilities.
Recommendation
Configure the Content-Security-Header to be sent with each HTTP response in order to apply the specific policies needed by the application.
Classification
| CWE | CWE-693 |
| OWASP Top 10 - 2017 | A6 - Security Misconfiguration |
| OWASP Top 10 - 2021 | A5 - Security Misconfiguration |
Evidence
| URL | Evidence |
|---|---|
| https://www.askul.co.jp/ol/0/ | Response headers do not include the Referrer-Policy HTTP security header as well as the <meta> tag with name 'referrer' is not present in the response. |
Vulnerability description
We noticed that the target application's server responses lack the <code>Referrer-Policy</code> HTTP header, which controls how much referrer information the browser will send with each request originated from the current web application.
Recommendation
The Referrer-Policy header should be configured on the server side to avoid user tracking and inadvertent information leakage. The value `no-referrer` of this header instructs the browser to omit the Referer header entirely.
Classification
| CWE | CWE-693 |
| OWASP Top 10 - 2017 | A6 - Security Misconfiguration |
| OWASP Top 10 - 2021 | A5 - Security Misconfiguration |
Evidence
| URL | Evidence |
|---|---|
| https://www.askul.co.jp/ol/0/ | Response headers do not include the X-Content-Type-Options HTTP security header |
Vulnerability description
We noticed that the target application's server responses lack the <code>X-Content-Type-Options</code> header. This header is particularly important for preventing Internet Explorer from reinterpreting the content of a web page (MIME-sniffing) and thus overriding the value of the Content-Type header.
Recommendation
We recommend setting the X-Content-Type-Options header such as `X-Content-Type-Options: nosniff`.
Classification
| CWE | CWE-693 |
| OWASP Top 10 - 2017 | A6 - Security Misconfiguration |
| OWASP Top 10 - 2021 | A5 - Security Misconfiguration |
Evidence
| Software / Version | Category |
|---|---|
| Microsoft Advertising | Advertising |
| Microsoft Clarity 0.7.63 | Analytics |
| Contentsquare | Analytics, A/B Testing |
| Criteo | Advertising, Retargeting |
| Adobe Experience Platform Identity Service | Customer data platform |
| Adobe Experience Platform Launch | Tag managers |
| Facebook Pixel 2.9.180 | Analytics |
| jQuery-pjax | Mobile frameworks |
| jQuery Migrate 3.4.0 | JavaScript libraries |
| core-js 3.32.2 | JavaScript libraries |
| Google Analytics | Analytics |
| Apache HTTP Server | Web servers |
| Java | Programming languages |
| jQuery 3.6.0 | JavaScript libraries |
| jQuery UI 1.8.1 | JavaScript libraries |
| RichRelevance \1 | Personalisation |
| Adobe Analytics | Analytics |
| Yahoo Advertising | Advertising, Retargeting |
| Google Tag Manager | Tag managers |
| HSTS | Security |
| JSP | Web frameworks |
| Cart Functionality | Ecommerce |
Vulnerability description
We noticed that server software and technology details are exposed, potentially aiding attackers in tailoring specific exploits against identified systems and versions.
Recommendation
We recommend you to eliminate the information which permits the identification of software platform, technology, server and operating system: HTTP server headers, HTML meta information, etc.
Classification
| OWASP Top 10 - 2017 | A6 - Security Misconfiguration |
| OWASP Top 10 - 2021 | A5 - Security Misconfiguration |
Evidence
Vulnerability description
We found the robots.txt on the target server. This file instructs web crawlers what URLs and endpoints of the web application they can visit and crawl. Website administrators often misuse this file while attempting to hide some web pages from the users.
Recommendation
We recommend you to manually review the entries from robots.txt and remove the ones which lead to sensitive locations in the website (ex. administration panels, configuration files, etc).
Classification
| OWASP Top 10 - 2017 | A6 - Security Misconfiguration |
| OWASP Top 10 - 2021 | A5 - Security Misconfiguration |
Vulnerability description
Website is accessible.
Vulnerability description
We have noticed that the server is missing the security.txt file, which is considered a good practice for web security. It provides a standardized way for security researchers and the public to report security vulnerabilities or concerns by outlining the preferred method of contact and reporting procedures.
Recommendation
We recommend you to implement the security.txt file according to the standard, in order to allow researchers or users report any security issues they find, improving the defensive mechanisms of your server.
Classification
| OWASP Top 10 - 2017 | A6 - Security Misconfiguration |
| OWASP Top 10 - 2021 | A5 - Security Misconfiguration |
Infrastructure Vulnerabilities
Evidence
| Domain Queried | DNS Record Type | Description | Value |
|---|---|---|---|
| webmail.askul.co.jp | SPF | Sender Policy Framework | "v=spf1 include:_spf.cmjp1.clickmailer.jp ~all" |
Vulnerability description
We found that the Sender Policy Framework (SPF) record for the domain is configured with ~all (soft fail), which indicates that emails from unauthorized IP addresses are not explicitly denied. Instead, the recipient mail server is instructed to treat these messages with suspicion but may still accept them. This configuration may not provide enough protection against email spoofing and unauthorized email delivery, leaving the domain more vulnerable to impersonation attempts.
Recommendation
We recommend changing the SPF record's ~all (soft fail) directive to -all (hard fail). The -all setting tells recipient mail servers to reject emails from any IP addresses not listed in the SPF record, providing stronger protection against email spoofing. Ensure that all legitimate IP addresses and services that send emails on behalf of your domain are properly included in the SPF record before implementing this change.
Evidence
| Domain Queried | DNS Record Type | Description | Value |
|---|---|---|---|
| webmail.askul.co.jp | A | IPv4 address | 210.152.119.120 |
| webmail.askul.co.jp | NS | Name server | ns1.clickmailer.jp |
| webmail.askul.co.jp | NS | Name server | ns2.clickmailer.jp |
| webmail.askul.co.jp | MX | Mail server | 10 ad01.clickmailer.jp |
| webmail.askul.co.jp | SOA | Start of Authority | ns1.clickmailer.jp. mis.clickmailer.jp. 2024032501 1800 600 604800 3600 |
| webmail.askul.co.jp | SPF | Sender Policy Framework | "v=spf1 include:_spf.cmjp1.clickmailer.jp ~all" |
Recommendation
We recommend reviewing all DNS records associated with the domain and identifying and removing unused or obsolete records.
Vulnerability description
OS detection couldn't determine the operating system.
Evidence
| Software / Version | Category |
|---|---|
| Apache HTTP Server | Web servers |
Vulnerability description
We noticed that server software and technology details are exposed, potentially aiding attackers in tailoring specific exploits against identified systems and versions.
Recommendation
We recommend you to eliminate the information which permits the identification of software platform, technology, server and operating system: HTTP server headers, HTML meta information, etc.
Evidence
| Software / Version | Category |
|---|---|
| Apache HTTP Server | Web servers |
Vulnerability description
We noticed that server software and technology details are exposed, potentially aiding attackers in tailoring specific exploits against identified systems and versions.
Recommendation
We recommend you to eliminate the information which permits the identification of software platform, technology, server and operating system: HTTP server headers, HTML meta information, etc.