Sysadmin PCI scan vulnerabilities

If you have a merchant account to process credit card payments, the merchant servicer will require your website to be scanned and pass the test every 3 months. If you fail, it will disable your merchant account, raise fee, etc.
This is a big and growing problem with many of us.

---

I got my scan passed in May and a new scan failed. I'm not sure if there is any updates from centminmod from last few months causing any issue.
If @eva2000 can jump in with some advice, that would be much appreciated.

Here are some issues that did not pass
HTTP Security Header Not Detected on port 80

Code:

Result

GET / HTTP/1.1
Host: 209.222.101.10
Connection: Keep-Alive



HTTP/1.1 200 OK
Date: Wed, 12 Aug 2020 10:46:41 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 4074
Last-Modified: Thu, 05 Apr 2018 17:10:07 GMT
Connection: keep-alive
Vary: Accept-Encoding
ETag: "5ac6586f-fea"
Server: nginx centminmod
X-Powered-By: centminmod
Accept-Ranges: bytes

X-XSS-Protection HTTP Header missing on port 80.

X-Content-Type-Options HTTP Header missing on port 80." style="box-sizing: border-box; color: rgb(99, 102, 106); font-family: Roboto, Tahoma, Arial, Helvetica, sans-serif; font-size: 14px; background-color: rgb(255, 255, 255);">X-Frame-Options or Content-Security-Policy: frame-ancestors HTTP Headers missing on port 80.

GET / HTTP/1.1
Host: 209.222.101.10
Connection: Keep-Alive



HTTP/1.1 200 OK
Date: Wed, 12 Aug 2020 10:46:41 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 4074
Last-Modified: Thu, 05 Apr 2018 17:10:07 GMT
Connection: keep-alive
Vary: Accept-Encoding
ETag: "5ac6586f-fea"
Server: nginx centminmod
X-Powered-By: centminmod
Accept-Ranges: bytes

X-XSS-Protection HTTP Header missing on port 80.

X-Content-Type-Options HTTP Header missing on port 80.

Solution

Code:

Note: To better debug the results of this QID, it is requested that customers execute commands to simulate the following functionality: curl -lkL --verbose.
CWE-693: Protection Mechanism Failure mentions the following - The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack. An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended. Finally, an "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.
Customers are advised to set proper X-Frame-Options, X-XSS-Protection, X-Content-Type-Options and Strict-Transport-Security HTTP response headers.
Depending on their server software, customers can set directives in their site configuration or Web.config files. Few examples are:
X-Frame-Options:
Apache: Header always append X-Frame-Options SAMEORIGIN
nginx: add_header X-Frame-Options SAMEORIGIN;
HAProxy: rspadd X-Frame-Options:\ SAMEORIGIN
IIS: <HTTPPROTOCOL><CUSTOMHEADERS><ADD NAME="X-Frame-Options" VALUE="SAMEORIGIN"></ADD></CUSTOMHEADERS></HTTPPROTOCOL>
X-XSS-Protection:
Apache: Header always set X-XSS-Protection "1; mode=block" 
PHP: header("X-XSS-Protection: 1; mode=block");
X-Content-Type-Options:
Apache: Header always set X-Content-Type-Options: nosniff
HTTP Strict-Transport-Security:
Apache: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Nginx: add_header Strict-Transport-Security max-age=31536000;
Note: Network devices that include a HTTP/HTTPS console for administrative/management purposes often do not include all/some of the security headers. This is a known issue and it is recommend to contact the vendor for a solution.
" style="box-sizing: border-box; padding: 10px; line-height: 1.4286; vertical-align: middle; border: none;">Note: To better debug the results of this QID, it is requested that customers execute commands to simulate the following functionality: curl -lkL --verbose.
CWE-693: Protection Mechanism Failure mentions the following - The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack. An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended. Finally, an "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path.

Customers are advised to set proper X-Frame-Options, X-XSS-Protection, X-Content-Type-Options and Strict-Transport-Security HTTP response headers.

Depending on their server software, customers can set directives in their site configuration or Web.config files. Few examples are:

X-Frame-Options:
Apache: Header always append X-Frame-Options SAMEORIGIN
nginx: add_header X-Frame-Options SAMEORIGIN;
HAProxy: rspadd X-Frame-Options:\ SAMEORIGIN
IIS: <HTTPPROTOCOL><CUSTOMHEADERS><ADD NAME="X-Frame-Options" VALUE="SAMEORIGIN"></ADD></CUSTOMHEADERS></HTTPPROTOCOL>

X-XSS-Protection:
Apache: Header always set X-XSS-Protection "1; mode=block"
PHP: header("X-XSS-Protection: 1; mode=block");

X-Content-Type-Options:
Apache: Header always set X-Content-Type-Options: nosniff

HTTP Strict-Transport-Security:
Apache: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Nginx: add_header Strict-Transport-Security max-age=31536000;

Note: Network devices that include a HTTP/HTTPS console for administrative/management purposes often do not include all/some of the security headers. This is a known issue and it is recommend to contact the vendor for a solution.

The same issue on port 443

 

I'm testing again the IP for the server that hosting my main domain and my other domains.
It seems to pick up setting on other other domains as well.
I dont know why it passed 3 months ago and failed now.

I'm testing again using the domain name and will see if it makes a difference.

 

I got some issue with this site as it keeps asking me to do the hcapcha puzzle even if i already logged in. Not sure the reason.

 

PCI reports also said that it detected an old version of jquery but i couldn't grep to find where the file contains that string is
jquery/jquery-3.3.1.min.js?_v=51091b27

Any tip?

 

It only happens after I reset my Chrome browser. What do I need to do?