How to remediate – WAS Target Discovery for PCI

1. Introduction

The WAS Target Discovery for PCI plugin identifies websites on a system that are targeted for Payment Card Industry Data Security Standard (PCI DSS) Web Application Scanning. This is important because it indicates systems within scope of PCI scanning, requiring appropriate security controls and monitoring to protect cardholder data. Affected systems typically include web servers and applications handling payment processing or storing related information. A successful scan could lead to sensitive data exposure.

2. Technical Explanation

This plugin detects websites configured for use with a PCI WAS scanner. The root cause is the presence of configuration settings indicating these sites are subject to security assessments. Exploitation involves identifying these targets, which can then be probed for vulnerabilities during a scan. There is no specific CVE associated with this discovery; it’s an indicator of scanning activity rather than a direct vulnerability itself.

• Root cause: Configuration settings defining PCI WAS scan targets.
• Exploit mechanism: An attacker identifies systems in scope for PCI scans, potentially leading to targeted attacks based on discovered vulnerabilities.
• Scope: Web servers and applications configured for PCI DSS compliance scanning.

3. Detection and Assessment

Confirming a system is vulnerable involves checking its configuration for settings related to PCI WAS scanning. A quick check can identify scan target definitions, while thorough assessment requires reviewing all relevant web application configurations.

• Quick checks: Examine web server configuration files (e.g., Apache httpd.conf, Nginx nginx.conf) or application settings for references to PCI DSS scanning tools or URLs.
• Scanning: Nessus plugin ID 10423 can identify WAS targets. This is an example only.
• Logs and evidence: Review web server access logs for requests from the PCI WAS scanner’s IP address range.

grep -i "pci dss" /etc/httpd/conf/httpd.conf

4. Solution / Remediation Steps

Fixing this issue involves ensuring only necessary systems are targeted for PCI WAS scanning and that appropriate security measures are in place to protect those systems.

4.1 Preparation

• Ensure you have access to web server configuration files. A roll back plan involves restoring the original configuration file.
• A change window may be needed depending on service impact. Approval from the application owner is recommended.

4.2 Implementation

1. Step 1: Review all web application configurations to identify PCI WAS scan targets.
2. Step 2: Remove any unnecessary or outdated target definitions.
3. Step 3: Verify that only required systems are included in the scan scope.

4.3 Config or Code Example

Before

# PCI DSS Scan Target
ScanTargetURL=https://example.com/payment

After

# PCI DSS Scan Target - Removed unnecessary target
#ScanTargetURL=https://example.com/payment

4.4 Security Practices Relevant to This Vulnerability

Practices that directly address this vulnerability type include least privilege and secure configuration management.

• Practice 1: Least privilege – limit the number of systems in scope for PCI DSS scanning to reduce the attack surface.
• Practice 2: Secure configuration management – regularly review web server configurations to ensure only necessary services and targets are enabled.

4.5 Automation (Optional)

# Example Bash script to remove PCI scan targets from config files
find /etc/httpd -name httpd.conf -print0 | while IFS= read -r file; do
  sed -i '/ScanTargetURL=/d' "$file"
done
#Caution: This removes all lines containing "ScanTargetURL=", review carefully before running!

5. Verification / Validation

Confirming the fix involves verifying that unnecessary scan targets have been removed and re-running the detection method to confirm they are no longer present.

• Post-fix check: Run `grep -i “pci dss” /etc/httpd/conf/httpd.conf`. Expected output should be empty or only contain comments.
• Re-test: Re-run the Nessus plugin ID 10423 to confirm it no longer identifies unnecessary WAS targets.
• Monitoring: Monitor web server logs for unexpected requests from PCI DSS scanning IP addresses.

grep -i "pci dss" /etc/httpd/conf/httpd.conf

6. Preventive Measures and Monitoring

Preventive measures include updating security baselines and incorporating checks into CI/CD pipelines.

• Baselines: Update a security baseline or policy to restrict the configuration of PCI DSS scan targets. For example, CIS control 1.2.
• Pipelines: Add static analysis checks in CI/CD pipelines to prevent the inclusion of unnecessary scan target definitions in web server configurations.
• Asset and patch process: Review system configurations regularly as part of a defined asset management process.

7. Risks, Side Effects, and Roll Back

Risks include disrupting PCI DSS scanning if legitimate targets are removed. Roll back involves restoring the original configuration file.

• Roll back: Restore the original web server configuration file from the backup taken in step 4.1.

8. References and Resources

• Vendor advisory or bulletin: N/A – This is a configuration issue, not a specific vendor vulnerability.
• NVD or CVE entry: N/A – No specific CVE associated with this discovery.
• Product or platform documentation relevant to the fix: Apache HTTP Server Documentation: https://httpd.apache.org/docs/