HSTS Not Enforced on Remote Web Server for DMT.EM Component (Servers: Server 1, Server 2)

west_liu — Tue, 27 May 2025 02:58:10 GMT

To SAS Viya Support Team,

Greetings,

During a security scan, we identified a critical vulnerability on the following servers where HSTS (HTTP Strict Transport Security) is not enforced on the remote web server for the DMT.EM component, in violation of RFC 6797:

1. Vulnerability Details

Component/Service: DMT.EM
Vulnerability Description: The remote web server does not enforce HSTS, leaving it susceptible to man-in-the-middle (MITM) attacks.
Affected Servers:
- Server 1
- Server 2
Vulnerability ID: 42
Remediation Recommendation: Configure the remote web server to enforce HSTS.

2. Requested Assistance

Please advise on the specific steps to enable HSTS for the DMT.EM component in the SAS Viya environment, including any configuration files or settings that need modification.
Confirm whether this requires changes to the SAS Viya configuration or can be addressed at the web server level (e.g., Apache, Nginx).
Provide guidance on verifying the successful implementation of HSTS post-configuration (e.g., using browser tools or security headers checkers).

3. Severity and Timeline

This vulnerability poses a high risk to data security. We kindly request a priority response and a detailed action plan by [Insert Deadline, e.g., 24 hours from ticket creation].

Thank you for your prompt support.

Best regards,

West

Re: HSTS Not Enforced on Remote Web Server for DMT.EM Component (Servers: Server 1, Server 2)

SASKiwi — Tue, 27 May 2025 04:08:51 GMT

To get a priority response open a ticket via the Tech Support channel: https://service.sas.com/

topic HSTS Not Enforced on Remote Web Server for DMT.EM Component (Servers: Server 1, Server 2) in SAS Viya

HSTS Not Enforced on Remote Web Server for DMT.EM Component (Servers: Server 1, Server 2)

Re: HSTS Not Enforced on Remote Web Server for DMT.EM Component (Servers: Server 1, Server 2)