Passive Mixed Content Vulnerability

How to Find Mixed Content Vulnerability & Report

About That's Mixed Content

Mixed content refers to a situation where a web page contains both secure (HTTPS) and non-secure (HTTP) elements. It typically arises when a webpage is loaded over a secure connection (HTTPS), but certain resources within that page, such as images, scripts, or stylesheets, are referenced using insecure HTTP URLs.

The HTTP Content-Security-Policy (CSP) block-all-mixed-content directive prevents loading any assets over HTTP when the page uses HTTPS. All mixed content resource requests are blocked, including both active and passive mixed content.

What is Passive Mixed Content ?

Passive Mixed Content specifically handles insecure resources on secure HTTPS webpages that are loaded over HTTP. These resources are called passive because they are not used to interact with the content of the webpage or execute scripts, which may affect the security of the webpage.

Examples of passive mixed content include images, stylesheets, or fonts that are loaded via HTTP. These resources do not execute code directly, but they can be manipulated during iteration.

How To Find ?

STEP #1: Open any Mixed Content Checker online site, search the domain in it, you will get the Vulnerable Link 

STEP #2: After opening the link, you will have the site in your browser, then press F12, you will get the URL(HTTP) of the Passive mixed content.

Impact : 

Passive mixed content refers to the presence of insecure resources, such as images, videos, or stylesheets, within a secure webpage (HTTPS). These insecure resources are loaded over an unencrypted HTTP connection, which can potentially compromise the security and privacy of the page and its users. The impact of passive mixed content can be significant 

Mitigation :

Update the URLs of all active content to use a secure connection (HTTPS). This includes images, videos, pdf, or any other active elements. Ensure that the references to these resources use "https://" instead of "http://".

                                 How to Report Vulnerability ?

Hello Team

                 I'm Career Technology Cyber Security India a white security researcher from Mumbai INDIA, founded a vulnerability on your website ie:https://www.example.com/

Vulnerability Name: Passive mixed content

Vulnerable URL: https://www.example.com/support-us

Descriptions  :

Mixed active content is content that has access to all or parts of the Document Object Model of the HTTPS page. This type of mixed content can alter the behavior of the HTTPS page and potentially steal sensitive data from the user.

Solutions: simply apply https on the given URL   

https://www.example.com/support-us

Steps to Reproduce :

1. visit given URL

2. go to inspect element

3.then go to console you will get mixed content error

Impact:

Passive mixed content includes resources whose impact on the page's overall behavior is more minimal, such as images, audio, and video. Browsers will load passive mixed content, but will typically change the HTTPS indicator.

Mitigation:

The best strategy to avoid mixed content blocking is to serve all the content as HTTPS instead of HTTP. For your own domain, serve all content as HTTPS and fix your links. Often, the HTTPS version of the content already exists and this just requires adding an "s" to links - http:// to https://.

PFA of video for steps by steps guidance also help to regenerate the vulnerability

Thanks & Regard,

Career Technology Cyber Security India 

Indian Bug Hunter