Severity: Medium
Invicti detected that BREACH (Browser Reconnaissance & Exfiltration via Adaptive Compression of Hypertext) attack is possible on this website.
Due to elements that make BREACH attack possible, SSL/TLS protected traffic remains vulnerable and can be attacked to uncover information from the website.
Regardless of which version of SSL/TLS you use, attacks are still possible. Attacks do not require TLS-layer compression and they can work against any cipher suite.
Even if you use an SSL/TLS protected connection, an attacker can still view the victim’s encrypted traffic and cause the victim to send HTTP requests to the vulnerable web server (by using invisible frames). Following these steps, an attacker could steal information from the website and do the following:
Netsparker reported a Possible BREACH Attack issue because the target web page meets the following conditions that facilitate it:
To mitigate the issue, we recommend the following solutions: