Rule Definition
Security misconfiguration is the most commonly seen issue. This is commonly a result of insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information. Not only must all operating systems, frameworks, libraries, and applications be securely configured, but they must be patched/upgraded in a timely fashion.

Remediation
Do not disable SSL_VERIFYPEER attribute

Violation Code Sample

import * as http from 'http'; 
import * as curl from 'node-curl'; 

http.createServer(function(request,response){ 

    var url = 'https://url'; 
    url += request.url; 

    curl(url, 
        { 
            SSL_VERIFYPEER : 0 
        }, 
        function(err){ 
            response.end(this.body); 
        }) 

}).listen(8000);

Fixed Code Sample

import * as http from 'http'; 
import * as curl from 'node-curl'; 

http.createServer(function(request,response){ 

    var url = 'https://url'; 
    url += request.url; 

    curl(url, 
        function(err){ 
            response.end(this.body); 
        }) 

}).listen(8000);

https://cwe.mitre.org/data/definitions/295.html https://www.owasp.org/index.php/Top_10_2013-A5-Security_Misconfiguration https://www.owasp.org/index.php/Top_10-2017_A6-Security_Misconfiguration