EVALUASI DAN MITIGASI SERANGAN XSS DAN CSRF PADA OPEN JOURNAL SYSTEMS VERSI 3.5 MENGGUNAKAN PENETRATION TESTING DAN CVSS SCORING

Abstrak

Open Journal Systems (OJS) merupakan aplikasi pengelolaan jurnal berbasis web yang rentan terhadap serangan Cross-Site Scripting (XSS) dan Cross-Site Request Forgery (CSRF). Penelitian ini bertujuan mengevaluasi kerentanan keamanan pada OJS versi 3.5, mengukur tingkat risikonya menggunakan Common Vulnerability Scoring System (CVSS) v4.0, menerapkan mitigasi pada kode sumber, serta memvalidasi efektivitasnya melalui retesting. Metode yang digunakan adalah Penetration Testing yang menggunakan black-box testing dengan mengacu pada OWASP Web Security Testing Guide (WSTG) dan Penetration Testing Execution Standard (PTES). Tahapan penelitian meliputi pemindaian kerentanan, pengujian eksploitasi, analisis kode sumber, penilaian risiko menggunakan CVSS, implementasi secure coding, dan retesting. Hasil penelitian menunjukkan bahwa pendekatan Penetration Testing mampu mengidentifikasi kerentanan XSS dan CSRF pada OJS versi 3.5. Mitigasi yang diterapkan berhasil meningkatkan keamanan aplikasi dan mengurangi peluang eksploitasi berdasarkan hasil pengujian ulang. Penelitian ini menunjukkan bahwa kombinasi Penetration Testing, CVSS, dan secure coding merupakan pendekatan yang efektif untuk mengevaluasi dan meningkatkan keamanan OJS terhadap serangan XSS dan CSRF.

Open Journal Systems (OJS) is a web-based journal management application that is vulnerable to Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) attacks. This study aims to evaluate security vulnerabilities in OJS version 3.5, assess their risk levels using the Common Vulnerability Scoring System (CVSS) v4.0, implement mitigation measures in the source code, and validate their effectiveness through retesting. The research employs a Penetration Testing approach using black-box testing based on the OWASP Web Security Testing Guide (WSTG) and the Penetration Testing Execution Standard (PTES). The research stages include vulnerability scanning, exploitation testing, source code analysis, risk assessment using CVSS, implementation of secure coding practices, and retesting. The results indicate that the Penetration Testing approach successfully identified XSS and CSRF vulnerabilities in OJS version 3.5. The implemented mitigation measures effectively enhanced the application's security and reduced the likelihood of successful exploitation based on the retesting results. This study demonstrates that the combination of Penetration Testing, CVSS, and secure coding practices is an effective approach for evaluating and improving the security of OJS against XSS and CSRF attacks.