Nodejs - Expressjs SSL (HTTPS) BEAST Attack — Node not honoring order

0
votes

I have an SSL Cert with EV and I am following Eric Martindale's instructions for mitigating the BEAST Attack, but I am still showing a vulnerability to the attack.

According to SSL Labs it only lists these ciphers and IGNORES the order even though I set honorCipherOrder:

Cipher Suites (sorted by strength; server has no preference)
TLS_RSA_WITH_RC4_128_SHA (0x5) 128
TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) 128
TLS_RSA_WITH_AES_256_CBC_SHA (0x35) 256

BEAST attack Vulnerable INSECURE

Here's my code:

THE MODULE
module.exports = {
    key: fs.readFileSync(__dirname + '/../vault/ssl/' + serverInfo.serverType + '.key'),
    cert: fs.readFileSync(__dirname + '/../vault/ssl/' + serverInfo.serverType + '.pem'),
    ciphers: 'ECDHE-RSA-AES256-SHA:AES256-SHA:RC4-SHA:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM',
    honorCipherOrder: true
};

THE SERVER.JS FILE
var sslOptions = require(__dirname + '/app_modules/ssl.js');
https.createServer(sslOptions, app).listen(securePort);

How can I protect against the BEAST attack? It seems like the order needs to be honored but it is not.

2
node.jssslexpress

2 Answers

0
votes

Used this solution here.

https://certsimple.com/blog/a-plus-node-js-ssl

This is the list of ciphers to use to mitigate forward secrecy issue.

[
    "ECDHE-RSA-AES256-SHA384",
    "DHE-RSA-AES256-SHA384",
    "ECDHE-RSA-AES256-SHA256",
    "DHE-RSA-AES256-SHA256",
    "ECDHE-RSA-AES128-SHA256",
    "DHE-RSA-AES128-SHA256",
    "HIGH",
    "!aNULL",
    "!eNULL",
    "!EXPORT",
    "!DES",
    "!RC4",
    "!MD5",
    "!PSK",
    "!SRP",
    "!CAMELLIA"
]