Description:
I am running Password Services, and when I am running Penetration Test, I discover that vulnerability has been found in the 'Change Password' form on the following parameters: SNENC, SMTOKEN, TARGET and USERNAME which compromise the security of the environment. How can I avoid this?
Solution:
Set the following ACO parameters:
Badurlchars
Csschecking
SecureURLs
If you are using a .fcc file for logout then in the logoffuri paramteer you need to set SMQUERYDATA. For e.g. logoffuri should be something like:
/AAA/logout.fcc?SMQUERYDATA=-SM-
and not /AAA/logout.fcc
Since SecureURLs is enabled, webagent will look for SMQUERYDATA in the url every time it process an .fcc file.