NOcius720147 (Community Member) asked a question.
I would like to know if there is a fix for the CWE 757 Selection of Less-Secure ALgorithm During Negotiation (Algorithm Downgrade)?
I would like to know if there is a fix or how to remediate the CWE 757 Selection of Less-Secure ALgorithm During Negotiation (Algorithm Downgrade).
TLSv1.2 cipher TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLSv1.2 cipher TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA256
I got the result from the dynamic analysis scan. and as per our dev team, they have already set to latest security policy (ELBSecurityPolicy-FS-1-2-Res-2019-08) in AWS end. is this enough? there is no options to disable CBC and keep GCM alone.
I advised them to disable the entire cipher suites with CBC. But according to them, Unlike traditional system AWS(alb) is not having option to disable/enable specific cipher.
Thank you.
.png){kind=logo}
Hi @NOcius720147 (Community Member) ,
For CWE 757, you'll want to disable the entire cipher suite. We typically would flag for this CWE if you're not using an Advance category of ciphers: https://cheatsheetseries.owasp.org/cheatsheets/TLS_Cipher_String_Cheat_Sheet.html#table-of-the-ciphers-and-their-priority-from-high-1-to-low-eg-18 . Keep in mind that it's not wrong to use any of the Broad or Widest Compatibility ciphers. We're just pointing out that you're not using the most secure cipher available. For some applications, you might need to use Broad or Widest Compatibility ciphers for compatibility reasons with certain server or browser. If you're able to use the Advanced cipher, rescanning would remove the finding. If you need to use the other ciphers for compatibility, you'll likely need to discuss with your security team and mitigate accordingly with certain understanding of the risk acceptance: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ .
Alternatively, you could consider switching to an alternative like AWS ELB that does allow configuring the supported ciphers, example configuration can be found on the Mozilla SSL Configuration Generator: https://ssl-config.mozilla.org/#server=awselb&config=intermediate .
Thank you,
Boy Baukema