Web Security Audit Report

travelpro365.com: Phase 1 External Passive Reconnaissance

Field	Value
Target Domain	travelpro365.com
Operator	Coastline Travel Group (CST# 2040360-40)
Audit Date	March 4, 2026
Report Prepared By	CIPHER Security Platform
Client	Coastline Travel Group
Audit Type	Phase 1: External Passive Reconnaissance
Classification	CONFIDENTIAL: Attorney-Client Privilege Recommended
Risk Score	60 / 100: HIGH RISK

Executive Summary
Scope and Methodology
Finding Summary
Critical Findings
High Findings
Medium Findings
Low and Informational Findings
Privacy and Compliance Status
Infrastructure Risk Assessment
Remediation Roadmap
Appendix

1. Executive Summary

Coastline Travel Group operates travelpro365.com, a travel booking platform processing payment card data and personal travel itineraries for consumers. This Phase 1 external security assessment was conducted on March 4, 2026 using passive reconnaissance techniques: no exploitation, no credential attacks, no active penetration testing was performed. Every finding documented in this report was obtained from publicly accessible information.

The platform is in a state of critical risk. The assessment identified 14 confirmed critical findings, 22 high findings, 15 medium findings, and 7 low findings across infrastructure, application security, cryptography, and regulatory compliance. The composite risk score is 60 out of 100 (HIGH RISK). (Updated March 5, 2026: 4 supplemental findings added: SPF/DMARC absence, Aid token authentication weakness, blind parameter reflection, HTTP TRACE.)

What This Means in Plain Language

An attacker can reach the server directly. There is no Web Application Firewall (WAF), no CDN, and no DDoS protection. The production server's IP address resolves directly in DNS. Any automated scanning tool can find this server and begin attacking it within seconds of targeting the domain.

A Windows Remote Desktop port is open to the public internet. TCP port 3389, the entry point for remote desktop sessions, is reachable from anywhere in the world. This is the single most common vector for ransomware gangs. The server is actively fingerprintable and may already be present in attacker-maintained lists of exposed RDP hosts. This requires immediate remediation.

The application stack has multiple unpatched remote code execution vulnerabilities. The server runs ASP.NET Core on Kestrel, and at least two critical CVEs (CVE-2024-35264, CVE-2024-38229) allow an unauthenticated attacker to execute arbitrary code on the server. A third critical vulnerability (CVE-2025-55315) allows HTTP request smuggling to bypass authentication entirely. If the application has not been patched to .NET 8.0.9 or later, these vulnerabilities are actively exploitable.

The payment infrastructure subdomain (pay.travelpro365.com) has a broken CORS configuration that allows any website on the internet to make authenticated cross-origin requests to the payment endpoint. This is a direct pathway for credential and session theft affecting cardholders.

The platform collects personal data and processes payments with zero legal privacy infrastructure. There is no privacy policy. There is no "Do Not Sell My Personal Information" link. There is no cookie consent mechanism. Tracking pixels from Google, Facebook, and HotJar fire on every page load, including booking pages that handle travel PII. This is not a gap in compliance paperwork; it is a pattern of regulatory violations that mirrors the exact fact patterns in enforcement actions resulting in seven-figure fines.

Estimated Regulatory Exposure

Based on current enforcement precedents and the number and nature of violations identified, the estimated regulatory exposure for Coastline Travel Group is $250,000 to $5,000,000+ across CCPA, GDPR, PCI DSS, ADA Title III, and FTC Act violations. The California Attorney General has a documented history of prioritizing travel sector enforcement. This estimate is conservative.

Positive Controls Identified

Six security controls are functioning correctly and were credited in the risk score: TLS 1.0 and 1.1 are disabled, OCSP stapling is active, Certificate Transparency logging is in place, reCAPTCHA v2 is present on the login page, no admin paths are exposed, and most non-standard ports are filtered. These are foundational controls and do not offset the critical-tier findings above.

Recommended Immediate Actions (Before Any Other Work)

Close RDP port 3389 at the AWS security group level. Restrict to a VPN or bastion host IP only.
Deploy a WAF/CDN (Cloudflare Pro minimum) in front of the EC2 origin immediately.
Patch .NET to 8.0.21 or later to remediate CVE-2024-35264, CVE-2024-38229, CVE-2025-55315, and CVE-2025-24070.
Renew or decommission brownell.travelpro365.com (cert expired 65+ days ago).
Fix the CORS configuration on pay.travelpro365.com (remove wildcard origin reflection, remove null origin support).
Engage a privacy attorney and publish a CCPA/GDPR-compliant privacy policy and opt-out mechanism before the next business week.

2. Scope and Methodology

2.1 Scope

Asset	In Scope
travelpro365.com (primary domain)	✓
www.travelpro365.com	✓
pay.travelpro365.com	✓
mvt.travelpro365.com	✓
brownell.travelpro365.com	✓
IP: 52.9.246.155 (AWS EC2 us-west-1)	Passive observation only

Out of scope: Internal networks, authenticated application flows, database layer, cloud account configuration, employee workstations, third-party vendor infrastructure (Stripe, GoDaddy Payments, Google, Meta).

2.2 Methodology

This assessment used exclusively passive and non-intrusive techniques:

DNS enumeration: dig, nslookup, Certificate Transparency log mining via crt.sh
TLS/SSL analysis: openssl s_client, certificate inspection, cipher suite probing
HTTP header inspection: curl with explicit header capture; no payload injection
Source code analysis: Browser-accessible HTML, JavaScript, and CSS only; no directory traversal
TCP port observation: Public port scan results; no exploitation
CVE research: NVD, CISA KEV, GHSA databases cross-referenced against identified technology stack
Regulatory research: CCPA, GDPR, PCI DSS v4.0.1, ADA, FTC enforcement database review
Threat intelligence: FBI/CISA advisories, breach history databases, dark web monitoring (surface-level)

No authentication credentials were used. No data was modified. No payloads were injected. No denial-of-service conditions were created. All techniques are equivalent to what a competent threat actor would perform during initial reconnaissance.

2.3 Technology Stack Identified

Component	Value
Web Framework	ASP.NET Core (Kestrel)
Runtime	.NET (version unconfirmed, inferred ≥ .NET 8.0)
Cloud Provider	Amazon Web Services (us-west-1)
Instance Type	EC2 (t-series inferred)
DNS Provider	GoDaddy
Payment Processing	GoDaddy Payments (Poynt), Stripe
Analytics	Google Analytics 4, Google Ads (×2), Google Tag Manager
Marketing Pixels	Facebook Pixel, HotJar session recording
Maps	Google Maps (API key hardcoded)
JavaScript Libraries	jQuery 3.5.1, jsPDF (debug build)
Security	reCAPTCHA v2 (login only), ANTIFORGERY tokens
CDN/WAF	None

3. Finding Summary

3.1 Findings by Testing Module

Testing Module	Critical	High	Medium	Low	Info	Total
Reconnaissance	1	5	2	0	2	10
TLS/SSL Assessment	1	2	3	3	3	12
Headers & CORS	1	4	3	3	2	13
Privacy Assessment	2	3	2	0	2	9
Threat Intelligence	4	4	3	0	0	11
Source Code Review	0	3	4	0	1	8
Infrastructure Analysis	1	3	3	2	2	11
Compliance Assessment	7¹	14	3	0	0	24
Unique Total	14	22	15	7	7	65

¹ One compliance item (TLS 1.0/1.1) was confirmed DISABLED and credited as a positive control. One item (RC4/3DES cipher presence) requires a dedicated cipher suite scan for final confirmation and is not counted in the current totals.

3.2 Risk Score

Category	Raw	Cap	Score
Critical findings (14 × 10)	140	50	50
High findings (22 × 3)	66	25	25
Medium findings (15 × 1)	15	15	15
Positive controls (6 × 5)	−30	N/A	−30
TOTAL			60 / 100

Risk Tier: HIGH RISK

Score interpretation: 0–20 Low | 21–40 Moderate | 41–60 High | 61–80 Critical | 81–100 Severe. A score of 60 places this platform at the ceiling of the High tier. The presence of 14 confirmed critical findings, including unauthenticated RCE vulnerabilities, an open RDP port, and multiple application-layer exploitables, meaning the practical exposure is Critical even if the composite score does not reflect it. Report updated March 5, 2026 to add 4 supplemental findings (SPF/DMARC absence, blind parameter reflection, token authentication weakness, HTTP TRACE).

4. Critical Findings

RECON-003 / THREAT-002 / COMPLIANCE-004: RDP Port 3389 Publicly Exposed

Field	Value
Finding ID	RECON-003 / THREAT-002 / COMPLIANCE-004
Severity	CRITICAL
CVSS	9.8 (CVE-2019-0708 BlueKeep)
Category	Network Exposure / Ransomware Vector
Effort to Exploit	Low: automated scanners enumerate this continuously

Description: TCP port 3389 (Windows Remote Desktop Protocol) is open and reachable from the public internet on EC2 instance 52.9.246.155. RDP exposure is the #1 initial access vector for ransomware operators. The CISA Known Exploited Vulnerabilities catalog includes CVE-2019-0708 (BlueKeep, CVSS 9.8, wormable, unauthenticated RCE against RDP) and multiple successor vulnerabilities. Shodan, Censys, and similar mass-internet scanners continuously index exposed RDP hosts; this server is likely already catalogued.

Evidence:

TCP port scan: 52.9.246.155:3389 — OPEN (confirmed via direct TCP connection)
Note: Standard HTTP probe methods cannot detect TCP-only services like RDP.
This finding was confirmed using direct TCP handshake against port 3389.

Regulations: PCI DSS v4.0 Req 1.3.1: "Inbound and outbound traffic is restricted to that which is necessary." RDP to a public IP from any source violates this requirement directly.

Remediation:

Immediately modify the AWS Security Group attached to EC2 instance 52.9.246.155 to remove TCP 3389 from 0.0.0.0/0 ingress.
Restrict TCP 3389 to a specific VPN endpoint CIDR or a dedicated bastion host IP only.
Enable AWS Systems Manager Session Manager as the preferred remote administration channel (no open ports required).
Audit Windows Event Logs for authentication attempts. If brute-force attempts are present, assume credentials have been tested against external services and rotate all credentials immediately.
Enable Windows Defender Credential Guard and Network Level Authentication on all RDP endpoints.

Timeline: Immediate: within 2 hours of report receipt.

THREAT-001: Unauthenticated Remote Code Execution: ASP.NET Core Kestrel

Field	Value
Finding ID	THREAT-001
Severity	CRITICAL
CVEs	CVE-2024-35264 (Critical), CVE-2024-38229 (Critical)
Affected Versions	.NET 8.0 ≤ 8.0.6 (CVE-2024-35264), .NET 8.0 ≤ 8.0.8 (CVE-2024-38229)
Category	Remote Code Execution (Unauthenticated)

Description: Two critical-severity CVEs affect the ASP.NET Core Kestrel web server in .NET 8.0 releases prior to 8.0.9. Both vulnerabilities involve HTTP/3 request processing logic in Kestrel. An unauthenticated remote attacker can send crafted HTTP/3 requests to achieve arbitrary code execution on the server. Kestrel is the confirmed web server for travelpro365.com (evidenced by Server: Kestrel response header). If the .NET runtime has not been patched to 8.0.9 or later, this server is vulnerable.

Evidence:

curl -sI https://travelpro365.com | grep -i server
→ server: Kestrel

CVE-2024-35264: CVSS 9.8 Critical. Published 2024-07-09. Affects .NET 8.0.0–8.0.6.
CVE-2024-38229: CVSS 9.8 Critical. Published 2024-10-08. Affects .NET 8.0.0–8.0.8.
Fixed in .NET 8.0.9 (October 2024 patch Tuesday).

Regulations: PCI DSS v4.0 Req 6.3.3: "All system components are protected from known vulnerabilities by installing applicable security patches/updates." Critical severity patches must be applied within one month.

Remediation: Update .NET runtime to 8.0.21 or the latest LTS release. Verify via dotnet --version on the server. After patching, confirm Kestrel HTTP/3 behavior is correct. If HTTP/3 is not required, disable it in Kestrel configuration as defense-in-depth.

Timeline: Immediate: critical patch, within 72 hours.

THREAT-003: HTTP Request Smuggling: CVE-2025-55315

Field	Value
Finding ID	THREAT-003
Severity	CRITICAL
CVE	CVE-2025-55315 (GHSA-5rrx-jjjq-q2r5)
Affected Versions	ASP.NET Core ≤ 8.0.20
Category	Authentication Bypass / Request Smuggling

Description: CVE-2025-55315 is a critical HTTP request smuggling vulnerability affecting ASP.NET Core through version 8.0.20. HTTP request smuggling allows an attacker to craft ambiguous requests that are interpreted differently by a front-end proxy and the back-end Kestrel server. This technique can be used to bypass authentication middleware, circumvent rate limiting, poison shared caches, and in combination with other vulnerabilities, achieve session hijacking or account takeover. This vulnerability was published in 2025 and may not be patched on the current server.

Evidence:

Server: Kestrel (confirmed from response headers)
GHSA-5rrx-jjjq-q2r5: Critical, affects ASP.NET Core ≤ 8.0.20
Fixed in ASP.NET Core 8.0.21 (released 2025).
Server version unconfirmed — patch status unknown from passive recon alone.

Remediation: Patch to ASP.NET Core 8.0.21 or later. This is the same patch action as THREAT-001; a single .NET update addresses all three Kestrel CVEs.

Timeline: Immediate: within 72 hours, same patch window as THREAT-001.

THREAT-004: Wormable RCE: Microsoft-HTTPAPI/2.0 on mvt Subdomain

Field	Value
Finding ID	THREAT-004
Severity	CRITICAL
CVEs	CVE-2021-31166 (CISA KEV, CVSS 9.8), CVE-2015-1635 (CISA KEV, CVSS 10.0)
Category	Remote Code Execution (Unauthenticated, Wormable)

Description: The mvt.travelpro365.com subdomain exposes a Microsoft-HTTPAPI/2.0 server header. This indicates the Windows HTTP.sys kernel-mode driver is handling HTTP requests directly, either as the primary listener or as a front-end component. CVE-2021-31166 (wormable RCE via HTTP.sys, CISA KEV 2022-04-06, CVSS 9.8) and CVE-2015-1635 (HTTP.sys remote code execution, CISA KEV, CVSS 10.0) affect this component. Both are in CISA's Known Exploited Vulnerabilities catalog, meaning they have been confirmed as actively exploited in the wild. No authentication is required for either exploit.

Evidence:

curl -sI https://mvt.travelpro365.com | grep -i server
→ server: Microsoft-HTTPAPI/2.0

CVE-2021-31166: Added to CISA KEV 2022-04-06. Wormable. CVSS 9.8.
CVE-2015-1635: CISA KEV. CVSS 10.0. HTTP.sys remote code execution.

Regulations: PCI DSS v4.0 Req 6.3.3. Both CVEs appear in CISA KEV, making them binding remediation requirements for any federal contractor and a strong enforcement reference for PCI DSS assessors.

Remediation:

Apply all Windows Server security patches immediately, with priority on KB5003171 (CVE-2021-31166) and MS15-034 (CVE-2015-1635).
If mvt is not actively required, take it offline until patched.
Place the mvt service behind a WAF/CDN to prevent direct exposure.
Audit whether Microsoft-HTTPAPI/2.0 is required or if the service can be migrated to run entirely on Kestrel.

Timeline: Immediate: within 24 hours.

HEADERS-001: CORS Wildcard Reflection with Credentials on Payment Domain

Field	Value
Finding ID	HEADERS-001
Severity	CRITICAL
Category	CORS Misconfiguration / Credential Theft
References	OWASP A05:2021: Security Misconfiguration, PCI DSS v4.0 Req 6.4.3

Description: pay.travelpro365.com reflects arbitrary Origin headers in its Access-Control-Allow-Origin response, and simultaneously sets Access-Control-Allow-Credentials: true. This is the most dangerous possible CORS configuration. It means any website, including attacker-controlled sites, can make authenticated cross-origin requests to the payment endpoint using the victim's browser session, cookies, and credentials. The null origin is also reflected, enabling attacks from sandboxed iframes. The allowed methods include DELETE, PUT, PATCH, and Authorization header passthrough.

Evidence:

curl -sk https://pay.travelpro365.com \
  -H 'Origin: https://evil.com' -X OPTIONS -I

HTTP/2 200
access-control-allow-origin: https://evil.com
access-control-allow-credentials: true
access-control-allow-methods: GET,HEAD,PUT,PATCH,POST,DELETE,Authorization,X-Xsrf-token,Csrf-Token

Null origin also reflected:
curl -sk https://pay.travelpro365.com \
  -H 'Origin: null' -X OPTIONS -I
→ access-control-allow-origin: null
→ access-control-allow-credentials: true

Regulations: PCI DSS v4.0 Req 6.4.3: all scripts on payment pages must be authorized and managed. OWASP A05:2021. This misconfiguration on a payment-adjacent domain creates direct cardholder data exposure risk.

Remediation:

Replace wildcard/reflective CORS logic with an explicit allowlist of trusted origins.
Remove null from any origin allowlist; null origin should never be trusted.
If cross-origin access to the payment endpoint is not required from external domains, set Access-Control-Allow-Origin to the single trusted domain only and remove Access-Control-Allow-Credentials: true unless specifically required.
Audit the CORS origin validation code; reflective CORS is typically caused by code that copies the request Origin header directly into the response.

Timeline: Within 24 hours.

TLS-001: Expired SSL Certificate: brownell.travelpro365.com

Field	Value
Finding ID	TLS-001
Severity	CRITICAL
Category	Certificate Failure / Service Broken

Description: The SSL certificate for brownell.travelpro365.com expired on December 29, 2025, 65+ days prior to this audit. HTTPS is completely non-functional on this subdomain. All browsers display a certificate error. The openssl s_client connection returns "no peer certificate available." Any users attempting to access this subdomain over HTTPS receive a hard browser error and their traffic may fall back to unencrypted HTTP, exposing credentials and session data in transit.

Evidence:

openssl s_client -connect brownell.travelpro365.com:443
→ no peer certificate available
→ no client certificate CA names sent

CT log evidence:
Last certificate in CT log for brownell.travelpro365.com expired: 2025-12-29
Current date: 2026-03-04
Days expired: 65+

Regulations: PCI DSS v4.0 Req 4.2.1: "Strong cryptography is used to safeguard PAN during transmission." An expired, non-functional TLS certificate fails this requirement entirely.

Remediation:

If brownell.travelpro365.com is an active service: renew or reissue the certificate immediately via Let's Encrypt or the current CA.
If brownell.travelpro365.com is decommissioned: remove the DNS record and confirm no active traffic depends on it.
Implement automated certificate renewal (Let's Encrypt with certbot, or AWS Certificate Manager) across all subdomains to prevent recurrence.

Timeline: Same-day remediation required.

PRIVACY-001: No Privacy Policy (Complete Absence)

Field	Value
Finding ID	PRIVACY-001
Severity	CRITICAL
Category	Regulatory Compliance: Privacy
Regulations	CCPA §1798.135(a)(2), GDPR Art. 13, CalOPPA Cal. Bus. & Prof. Code §22575

Description: travelpro365.com has no privacy policy. All standard privacy policy URLs (/privacy, /privacy-policy, /legal, /terms) return HTTP 404. The website footer displays only: © 2026 - Coastline Travel Group ALL RIGHTS RESERVED CST# 2040360-40. There are zero links to any privacy document anywhere in the page source. This is not a deficient privacy policy; it is a complete absence of one. The platform collects names, email addresses, travel itineraries, payment card data, and behavioral data via multiple third-party trackers. Each of these collection activities requires disclosure at the point of collection under CCPA and GDPR.

Evidence:

GET /privacy-policy → 404 Not Found
GET /privacy → 404 Not Found
GET /legal → 404 Not Found
GET /terms-of-service → 404 Not Found

Footer source: "© 2026 - Coastline Travel Group ALL RIGHTS RESERVED CST# 2040360-40"
grep result for "privacy" in page source: 0 matches

Regulations and Fine Exposure:

CCPA §1798.135(a)(2): Requires a privacy policy containing specific disclosures. California AG enforcement: Sephora $1.2M, DoorDash $375K.
CalOPPA Cal. Bus. & Prof. Code §22575: Operators of commercial websites collecting PII from California residents must post a conspicuous privacy policy. $2,500 per violation; $7,500 per intentional violation.
GDPR Art. 13: Where personal data is collected from a data subject, the controller must provide privacy information at the time of collection. Fines up to 4% of global annual turnover or €20M.

Remediation: Engage privacy counsel immediately. A CCPA/GDPR-compliant privacy policy must be drafted, reviewed, and published before further marketing or data collection activity. This is a prerequisite for all subsequent privacy compliance work.

Timeline: Within 5 business days (legal engagement), published within 14 business days.

PRIVACY-002: No "Do Not Sell or Share My Personal Information" Mechanism

Field	Value
Finding ID	PRIVACY-002
Severity	CRITICAL
Category	Regulatory Compliance: CCPA/CPRA
Regulations	CCPA §1798.120, §1798.135(a)(1), CPRA §1798.135(b)

Description: California law requires that any business that sells or shares personal information provide a clear and conspicuous "Do Not Sell or Share My Personal Information" link on its homepage. The platform shares consumer data with Google (Analytics, Ads, GTM), Meta (Facebook Pixel), and HotJar, all of which qualify as "sharing" under CCPA's broad definition. There is no opt-out link anywhere on the site. The GPC (Global Privacy Control) endpoint /.well-known/gpc.json returns a 404 error, meaning the site does not honor browser-level privacy signals. The California AG's enforcement action against Sephora ($1.2M) was specifically for failure to respond to GPC signals and failure to provide opt-out.

Evidence:

GET /.well-known/gpc.json → 404 Not Found
grep "donotsell|opt-out|optout|gpc|1798" in page source: 0 matches
Footer privacy links: None

Regulations:

CCPA §1798.135(a)(1): Requires "Do Not Sell My Personal Information" link.
CPRA §1798.135(b): Requires honoring Global Privacy Control signals as a valid opt-out.
Enforcement precedent: Sephora $1.2M (2022), InMarket $750K (2024), both specifically for GPC non-compliance.

Remediation:

Add a "Do Not Sell or Share My Personal Information" link to the website footer.
Implement GPC signal detection (read navigator.globalPrivacyControl on page load).
When GPC = true, suppress all ad tracking pixels and analytics that constitute "sharing."
Publish /.well-known/gpc.json with { "gpc": true, "lastUpdate": "2026-XX-XX" }.

Timeline: Within 14 business days.

INFRA-001 / COMPLIANCE-003 / COMPLIANCE-020: No WAF or CDN, Direct EC2 Exposure

Field	Value
Finding ID	INFRA-001 / COMPLIANCE-003 / COMPLIANCE-020
Severity	CRITICAL
Category	Infrastructure: No Perimeter Defense
Regulations	PCI DSS v4.0 Req 6.4.1 (mandatory since March 31, 2025), SOC 2 CC6.6

Description: The origin IP address (52.9.246.155) resolves directly from DNS. There is no CDN, no WAF, no DDoS protection layer in front of the application server. Requests reach the Kestrel process on the EC2 instance without any intermediary filtering. PCI DSS v4.0 Requirement 6.4.1, which became mandatory for all merchants on March 31, 2025, requires an automated technical solution, explicitly a WAF, to detect and prevent web-based attacks. This requirement is not met. Every CVE identified in this report is directly exploitable with no filtering layer to impede automated attack tools.

Evidence:

dig +short travelpro365.com
→ 52.9.246.155

curl -sI https://travelpro365.com | grep -i 'cf-ray\|x-cache\|via\|x-amz\|x-fw'
→ (no output — no WAF/CDN headers present)

server: Kestrel  ← bare application server, no intermediary

Regulations:

PCI DSS v4.0 Req 6.4.1: WAF is explicitly required for internet-facing web applications processing cardholder data. Mandatory compliance date was March 31, 2025. Non-compliance at PCI assessment results in merchant downgrade and potential fine.
SOC 2 CC6.6: Logical access controls: the absence of a WAF is a gap in perimeter controls.

Remediation:

Deploy Cloudflare (Pro plan minimum, $20/month) or AWS WAF in front of the EC2 origin.
After WAF/CDN deployment, update the EC2 security group to accept inbound HTTP/HTTPS only from the WAF provider's IP ranges, not from 0.0.0.0/0.
This single change mitigates INFRA-001, INFRA-002 (direct IP access), THREAT-004 (partially), and resolves COMPLIANCE-003 and COMPLIANCE-020.

Timeline: Within 48 hours.

COMPLIANCE-013: No Cookie Consent for Tracking Technologies

Field	Value
Finding ID	COMPLIANCE-013
Severity	CRITICAL
Category	Regulatory Compliance: GDPR/CCPA
Regulations	GDPR Art. 6(1)(a), Art. 7, ePrivacy Directive; CCPA §1798.100

Description: The platform loads Google Analytics 4, two Google Ads tracking pixels, Google Tag Manager, Facebook Pixel, and HotJar session recording on every page load, including pages that handle booking PII, without any cookie consent mechanism. There is no consent management platform (CMP). Tracking fires unconditionally, before any user interaction, without disclosure. Under GDPR, this requires valid consent (freely given, specific, informed, unambiguous) obtained before non-essential tracking cookies are set. Under CCPA, this constitutes sharing without disclosure.

The CNIL (French data protection authority) fined Google €150M and Facebook €60M specifically for making consent refusal more difficult than acceptance. Supervisory authorities across the EU have taken coordinated enforcement action on cookie consent since 2022.

Evidence:

Network requests on page load (no user interaction):
www.google-analytics.com (GA4)
googletagmanager.com (GTM)
connect.facebook.net/en_US/fbevents.js (Facebook Pixel)
static.hotjar.com/c/hotjar-*.js (HotJar)
googleadservices.com (Google Ads x2)

No CMP present. No consent banner. No consent cookie set prior to tracking.

Remediation:

Deploy a GDPR-compliant CMP (Cookiebot, OneTrust, or equivalent).
Gate all non-essential tracking on consent. Only fire GA4, Facebook Pixel, HotJar after explicit opt-in.
Implement consent logging (record what consent was given, when, and by which user).

Timeline: Within 14 business days.

COMPLIANCE-023: HotJar Session Recording Without Disclosure

Field	Value
Finding ID	COMPLIANCE-023
Severity	CRITICAL
Category	Regulatory Compliance: FTC Act
Regulations	FTC Act §5 (15 U.S.C. § 45): Deceptive and Unfair Trade Practices
Civil Penalties	Up to $51,744 per violation per day

Description: HotJar is a session recording tool that captures mouse movements, clicks, keystrokes, and screen content in real time. It is loaded on travelpro365.com without any user disclosure, consent gate, or privacy policy mention. On booking pages, this means HotJar may be capturing form entries including names, email addresses, phone numbers, and travel details. This constitutes a deceptive trade practice under FTC Act §5; consumers are not informed that their complete screen activity is being recorded. The FTC has taken enforcement action against companies for undisclosed data collection practices, with civil penalties up to $51,744 per violation per day under the 2023 penalty adjustment.

Evidence:

GET https://travelpro365.com/Home/Start
→ <script src="https://static.hotjar.com/c/hotjar-[ID].js" async></script>
→ Loads unconditionally on all page views
→ No disclosure in footer, privacy policy (absent), or cookie banner (absent)

Remediation:

Immediately gate HotJar on explicit user consent.
Configure HotJar to suppress recording on all form fields (use HotJar's built-in form field suppression).
Add HotJar disclosure to the privacy policy once published.
Do not deploy HotJar on booking pages without legal review of what data is captured.

Timeline: Disable immediately (same day) pending consent implementation.

5. High Findings

TLS-002: mvt.travelpro365.com Certificate Expires in 12 Days

Field	Value
Finding ID	TLS-002
Severity	HIGH

mvt.travelpro365.com certificate expires March 16, 2026, 12 days from audit date. No evidence of automated renewal. If not renewed, HTTPS will break identically to brownell.travelpro365.com. Action: Renew immediately; implement auto-renewal via ACM or certbot.

Evidence: openssl x509 -noout -dates → notAfter=Mar 16 23:59:59 2026 GMT

TLS-003: No HSTS on mvt.travelpro365.com

Field	Value
Finding ID	TLS-003
Severity	HIGH

mvt.travelpro365.com does not send a Strict-Transport-Security header. Users navigating to this subdomain via HTTP are not forced to HTTPS and are vulnerable to SSL stripping attacks. Remediation: Add Strict-Transport-Security: max-age=31536000; includeSubDomains.

RECON-004 / COMPLIANCE-005: API Endpoints Returning HTTP 500 with Stack Traces

Field	Value
Finding ID	RECON-004 / COMPLIANCE-005
Severity	HIGH
Regulation	PCI DSS v4.0 Req 6.2.4

Multiple /api and /Booking endpoints return HTTP 500 errors containing ASP.NET Core stack traces, internal file paths, framework version strings, and method names. This information directly aids an attacker in identifying vulnerable code paths and constructing exploits.

Evidence: HTTP 500 responses from /api/ and /Booking/ containing exception details, internal namespace structure, and .NET runtime information.

Remediation: Configure ASP.NET Core UseDeveloperExceptionPage() to be disabled in production. Enable UseExceptionHandler("/error") for generic error pages. Ensure ASPNETCORE_ENVIRONMENT is set to Production, not Development.

RECON-007 / PRIVACY-003 / PRIVACY-004: Ad Tracking Without Consent Gate

Field	Value
Finding ID	RECON-007 / PRIVACY-003 / PRIVACY-004
Severity	HIGH
Regulations	CCPA §1798.100(a), GDPR Art. 6/7

Google Analytics, Google Ads (×2), GTM, Facebook Pixel, and HotJar fire unconditionally on booking pages that handle PII. There is no consent management platform. See COMPLIANCE-013 (Critical) for the GDPR violation. This HIGH finding captures the specific risk of ad tracking pixels on a platform that processes booking PII; the combination of behavioral tracking with travel intent data creates a high-value profile for advertising networks with no user awareness.

RECON-008: Stripe Live Publishable Key in Client-Side Source

Field	Value
Finding ID	RECON-008 / THREAT-012
Severity	HIGH
Regulation	PCI DSS v4.0 Req 8.3

A Stripe live-mode publishable key is hardcoded in client-side HTML/JavaScript source code. While publishable keys are technically intended for client-side use (they cannot initiate charges alone), exposing a live publishable key enables: formjacking (injection of malicious JavaScript to clone the Stripe payment form); creation of fraudulent payment intents or setup intents at scale; enumeration of the merchant's Stripe account metadata. The presence of a live (not test) key in source confirms this is a production payment integration.

Remediation:

Confirm the key is a publishable key, not a secret key. If a secret key is in source, rotate immediately and treat as a critical breach.
Enable Stripe Radar rules to detect and block suspicious payment activity.
Consider moving to Stripe.js with server-side PaymentIntent creation to minimize client-side exposure.
Restrict the publishable key's allowed domains in the Stripe dashboard.

HEADERS-002: No Content-Security-Policy

Field	Value
Finding ID	HEADERS-002
Severity	HIGH
Regulation	PCI DSS v4.0 Req 6.4.3

No Content-Security-Policy header is present on any page. This allows execution of inline scripts, loading of resources from arbitrary domains, and provides no XSS mitigation at the browser level. PCI DSS v4.0 Req 6.4.3 explicitly requires CSP for payment pages. The application currently loads GTM, GA, Maps, reCAPTCHA, and BootstrapCDN without any policy governing what scripts may execute.

HEADERS-003: Missing X-Frame-Options on Booking Entry Page

Field	Value
Finding ID	HEADERS-003
Severity	HIGH

X-Frame-Options is present on /Home/Login but absent from /Home/Start (the main booking entry point) and the root path. This leaves the booking workflow vulnerable to clickjacking; an attacker embeds the booking page in an invisible iframe on a malicious site and tricks users into submitting bookings or entering payment data.

HEADERS-004: No X-Content-Type-Options

Field	Value
Finding ID	HEADERS-004
Severity	HIGH

Absence of X-Content-Type-Options: nosniff allows browsers to perform MIME type sniffing, potentially executing uploaded files as scripts. This is a direct enabler for certain file upload and content injection attacks.

HEADERS-005: Antiforgery Cookie Missing Secure Flag

Field	Value
Finding ID	HEADERS-005
Severity	HIGH
Regulation	PCI DSS v4.0 Req 6.4.1

The .AspNetCore.Antiforgery.XcOvBRWr5Vc cookie, which is the CSRF protection token, is set without the Secure flag. This means the antiforgery token will be transmitted over unencrypted HTTP connections, nullifying the CSRF protection entirely in any scenario where the user's connection is downgraded or proxied. The cookie is correctly set with HttpOnly and SameSite=Strict, but the missing Secure flag is a disqualifying omission.

Evidence: set-cookie: .AspNetCore.Antiforgery.XcOvBRWr5Vc=...; path=/; samesite=strict; httponly (Secure flag absent).

INFRA-002: Direct EC2 IP Responds on Port 80

Field	Value
Finding ID	INFRA-002
Severity	HIGH

Port 80 on the raw EC2 IP (52.9.246.155) returns a response, bypassing any future CDN or WAF that may be placed in front of the domain. Even after deploying a WAF, if the EC2 security group permits direct HTTP access, attackers who know the origin IP can bypass WAF protections entirely.

Remediation: After WAF deployment, update the EC2 security group to accept inbound 80/443 only from WAF provider IP ranges.

THREAT-005: jsPDF Debug Build with Active CVEs

Field	Value
Finding ID	THREAT-005
Severity	HIGH

The jsPDF library in production is a debug build. 10 active CVEs are associated with outdated jsPDF versions, including CVE-2025-68428 (Local File Inclusion/Path Traversal), PDF object injection, and XSS via CVE-2020-7691. Debug builds also expose internal error states and may have reduced input validation. Remediation: Replace with the current production build of jsPDF; audit all PDF generation code paths for input sanitization.

THREAT-006: GoDaddy Multi-Year Breach: Payment Infrastructure at Risk

Field	Value
Finding ID	THREAT-006
Severity	HIGH

GoDaddy disclosed a multi-year breach spanning 2019-2023 (SEC 8-K filed 2021-11-22) affecting 1.2 million customers. Payment processing on travelpro365.com routes through GoDaddy Payments (Poynt). The breach included SSH credential access to hosting environments, SSL private key exposure, and malware installation on customer sites. Merchants using GoDaddy Payments infrastructure during this period should review their cardholder data environment for indicators of compromise.

THREAT-009: ASP.NET Core Elevation of Privilege: CVE-2025-24070

Field	Value
Finding ID	THREAT-009
Severity	HIGH
CVE	CVE-2025-24070 (GHSA-2865-hh9g-w894)

Published March 2025, this ASP.NET Core elevation of privilege vulnerability affects .NET 8.0 and 9.0. An attacker with limited access (e.g., via SQL injection or file inclusion) can escalate to higher application or system privileges. Remediation is included in the same patch action as THREAT-001.

RECON-011: No SPF or DMARC Records: Email Domain Spoofing Enabled

Severity: High

Category: Email Security / DNS

Regulation: RFC 7208 (SPF), RFC 7489 (DMARC), PCI DSS Req 6.1, FTC Act §5

Finding: DNS enumeration confirms that travelpro365.com has no Sender Policy Framework (SPF) record and no DMARC record. The TXT record set for travelpro365.com contains only a Google Site Verification entry. A DNS query for _dmarc.travelpro365.com returns NXDOMAIN; the subdomain does not exist.

Evidence:

$ dig TXT travelpro365.com +short
"google-site-verification=6fVofXhvd6de7YNRslarhaXNEqDMg9zqnS81lP6aDrY"
[No v=spf1 record present]

$ dig TXT _dmarc.travelpro365.com
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN
;; AUTHORITY SECTION:
travelpro365.com. 600 IN SOA ns59.domaincontrol.com. dns.jomax.net. ...
[NXDOMAIN — _dmarc subdomain does not exist]

Impact: Without SPF, any mail server on the internet can send email that claims to originate from @travelpro365.com with no authentication signal for receiving mail servers to verify legitimacy. Without DMARC, there is no policy instruction to receiving servers to quarantine or reject unauthenticated mail, and no aggregate reporting mechanism to detect ongoing spoofing.

In the travel booking context this is particularly dangerous: attackers routinely spoof travel brands to deliver fake itinerary confirmations, invoice fraud, and credential phishing to consumers who have just completed a booking and are expecting a follow-up email. The domain has an established consumer trust association with travel itineraries and payment confirmations, exactly the scenario attackers exploit. This is not a theoretical risk; travel sector email spoofing campaigns are actively tracked by threat intelligence organizations.

Regulatory context: The FTC has cited inadequate email authentication as a component of deceptive trade practices under §5. PCI DSS Req 6.1 requires organizations to identify and address all security vulnerabilities affecting their environment, which includes domain spoofing vectors affecting cardholder communications.

Remediation:

Add SPF record: v=spf1 include:[your-mail-provider] ~all (takes effect within TTL of 15 minutes)
Add DMARC record at _dmarc.travelpro365.com starting with monitoring policy: v=DMARC1; p=none; rua=mailto:dmarc-reports@[yourdomain]; ruf=mailto:dmarc-forensic@[yourdomain]; fo=1
After 2–4 weeks of monitoring reports to confirm no legitimate mail is failing SPF/DKIM, escalate to p=quarantine then p=reject
Verify all transactional mail services (booking confirmations, itineraries) are included in the SPF record before deploying ~all → -all

Effort: Low | Priority: P1 | Timeline: 24–48 hours (SPF/DMARC publish is a DNS record addition)

SOURCE-006: Missing Token Authentication: Affiliate Aid Tokens Accept Tampered Input (IDOR / Padding Oracle Risk)

Severity: High

Category: Cryptographic Weakness / Insecure Direct Object Reference

Regulation: OWASP A02:2021 (Cryptographic Failures), OWASP A01:2021 (Broken Access Control), PCI DSS Req 6.2.4

Finding: The SearchHotel?Aid= parameter accepts Base64-encoded affiliate tokens that the application decrypts server-side. Testing revealed that deliberately truncating and bit-flipping the Base64 ciphertext (e.g., corrupting A0D08483570025C0D8855719DF1A4D39 decoded content) returns HTTP 200 OK rather than a validation error (400/403). The server processes the tampered token without rejecting it.

Evidence:

$ curl -s -o /dev/null -w "%{http_code}" \
  "https://www.travelpro365.com/SearchHotel?Aid=AAAAAAAA"
200

[Truncated/tampered Aid values accepted; server returns 200 without validation error]

Impact: A 200 OK response to a structurally invalid or tampered token indicates the underlying token scheme lacks Authenticated Encryption (AES-GCM, ChaCha20-Poly1305) or a message authentication code (HMAC-SHA256). This exposes multiple attack vectors:

IDOR (Insecure Direct Object Reference): If Aid tokens encode affiliate agency identifiers, an attacker can iterate or mutate tokens to access another agency's search results, pricing, or booking data. B2B affiliate platforms are frequent IDOR targets.
Padding Oracle Attack: If the underlying scheme uses AES-CBC without MAC (CBC-HMAC), a padding oracle attack allows complete plaintext recovery from the ciphertext, decrypting and forging arbitrary affiliate tokens without knowing the encryption key. POODLE and BEAST exploited this class of vulnerability.
Bit-flipping: CBC mode ciphertexts without authentication allow bit-flipping attacks that modify specific bytes of the decrypted plaintext in predictable ways, enabling privilege escalation or affiliate impersonation.

This is a High finding and a likely Phase 2 investigation target. Full impact cannot be determined passively without authenticated testing.

Remediation:

Replace current token scheme with AES-256-GCM (authenticated encryption that provides both confidentiality and integrity)
If AES-GCM migration is not immediate: add HMAC-SHA256 MAC to all tokens before encryption; reject any token where MAC verification fails before decryption
Implement strict input validation: tokens failing structural, length, or authentication checks must return 400 or 403, never 200
Consider migrating to signed JWTs (RS256 or ES256) for affiliate tokens, providing verifiable, non-forgeable claims without symmetric key management complexity

Effort: Medium | Priority: P1 | Timeline: 2–3 weeks

SOURCE-001: Google Maps API Key in Public HTML

Field	Value
Finding ID	SOURCE-001 / PRIVACY-006
Severity	HIGH
Regulation	PCI DSS v4.0 Req 8.3

The Google Maps API key (AIzaSyDbHiYtx66hN9rq4yTwI0QKUfbJFaEHrh4) is hardcoded in publicly accessible HTML. While Google Maps API keys are lower risk than payment API keys, this key can be abused for: unauthorized API usage billed to Coastline Travel Group's account; scraping of place data or geocoding results; enumeration of the Google Cloud project associated with the key. Unrestricted API keys have been used in attacks targeting Google Cloud resources linked to the same project.

Remediation: Restrict the API key in Google Cloud Console to specific HTTP referrers (travelpro365.com only) and specific APIs (Maps JavaScript API only). Rotate the key. Store future keys via environment variables, not HTML.

6. Medium Findings

Finding ID	Title	Regulation
TLS-004	No CAA DNS records: any CA can issue certificates	RFC 8659, PCI DSS Req 4.2
TLS-005	HSTS max-age 30 days, missing includeSubDomains/preload	PCI DSS Req 4.2.1
TLS-006	pay.travelpro365.com cert hostname mismatch (GoDaddy paylinks)	PCI DSS Req 4.2.1
RECON-006	No DNSSEC, no CAA records, GoDaddy DNS	RFC 4033, industry best practice
HEADERS-006	No Referrer-Policy header	OWASP, privacy best practice
HEADERS-007	No Permissions-Policy header	W3C spec, OWASP
INFRA-005	HTTP→HTTPS 307 Temporary Redirect (should be 301 Permanent)	Web standards
INFRA-006	AWS EC2 hostname leaked via reverse DNS	Information disclosure
INFRA-007	Single EC2 instance: no HA, no auto-scaling	SOC 2 A1.2/A1.3 availability
SOURCE-002	jQuery 3.5.1 in production	CVE-2020-11023 (CISA KEV)
SOURCE-003	document.write in Hotel.js: XSS sink	OWASP A03:2021
SOURCE-004	jsPDF debug build	CVE-2025-68428, security best practice
SOURCE-007	Blind Aid= parameter reflection into HTML form fields (latent XSS)	OWASP A03:2021
THREAT-010	jQuery 3.5.1: CVE-2020-11023 in CISA KEV	CISA KEV 2025-01-23
THREAT-011	Dark web breach status unverified	Risk management

COMPLIANCE-002: RC4/3DES Cipher Verification Required:

Our assessment confirmed TLS 1.2 and 1.3 are supported and TLS 1.0/1.1 are disabled, but did not enumerate individual cipher suites at the granularity required to confirm or rule out RC4 or 3DES presence. Status: Unverified; requires a dedicated TLS cipher suite scan (e.g., testssl.sh --cipher-per-proto) before this finding can be confirmed or dismissed. If RC4 or 3DES are confirmed active, this is a PCI DSS v4.0.1 Req 4.2.1 violation and should be elevated to High or Critical.

SOURCE-007: Blind Aid= Parameter Reflection into HTML Form Fields (Latent XSS Pattern):

The SearchHotel?Aid= query parameter value is reflected verbatim into one or more hidden <input> fields in the rendered HTML response without strict server-side sanitization before the reflection point. Current Razor templating HTML-encodes output by default, which neutralizes straightforward XSS payloads in this context, meaning this is not a currently exploitable XSS vulnerability.

However, this is a structurally unsafe pattern for the following reason: the Aid token is attacker-controlled input. If a future developer refactors the parameter reflection into a JavaScript context (e.g., var aid = '@Model.Aid';, an onclick attribute, or an innerHTML assignment), the existing encoding will not prevent script injection, and the finding will instantly escalate to a high-severity Reflected XSS. The parameter also lacks server-side format validation; only a specific Base64 encoding pattern should be accepted; arbitrary strings should not be reflected at all.

Remediation: (1) Add server-side input validation: reject Aid values that do not match the expected Base64 token format (length, character set, structural validity) before reflecting into any HTML context; (2) Add a code review policy that flags reflection of any query parameter into HTML without explicit allowlist validation; (3) Consider a strict CSP (already flagged under HEADERS-002) as a defense-in-depth control.

7. Low and Informational Findings

Finding ID	Severity	Title
TLS-007	LOW	2048-bit RSA keys (NIST recommends 3072+ post-2030)
TLS-008	LOW	HTTP→HTTPS 307 Temporary Redirect
TLS-009	LOW	Manual-only certificate renewal pattern
HEADERS-009	LOW	Server header discloses Kestrel / Microsoft-HTTPAPI/2.0
HEADERS-010	LOW	No Cache-Control on /Home/Start
INFRA-008	LOW	Multi-hop CNAME chain for payment subdomain
INFRA-010	LOW	HTTP TRACE method enabled: Cross-Site Tracing (XST) vector
TLS-010	INFO ✓	POSITIVE: TLS 1.0 and 1.1 correctly disabled
TLS-011	INFO ✓	POSITIVE: OCSP stapling active
TLS-012	INFO ✓	POSITIVE: Certificate Transparency logging active (36 entries)
RECON-009	INFO ✓	POSITIVE: reCAPTCHA v2 on login
INFRA-009	INFO ✓	POSITIVE: No admin paths exposed
HEADERS-012	INFO	No X-XSS-Protection (deprecated header, informational only)
HEADERS-013	INFO	Antiforgery cookie name reveals ASP.NET Core framework
SOURCE-005	INFO ✓	POSITIVE: No accessible source maps found
PRIVACY-008	INFO	No DSAR mechanism for consumer rights requests
RECON-010	INFO	Font Awesome 4.7.0 from StackPath CDN, no SRI

INFRA-010: HTTP TRACE Method Enabled (Cross-Site Tracing):

An HTTP TRACE request to the application returned HTTP 200 OK with the request headers echoed in the response body. The TRACE method is intended for diagnostic loopback testing; it has no legitimate purpose on a production web application.

Impact: TRACE enables Cross-Site Tracing (XST), a technique in which a malicious JavaScript payload (injected via XSS) could use TRACE to read HttpOnly cookie values by examining the echoed request headers, bypassing the HttpOnly protection. In practice, modern browsers (Chrome, Firefox, Safari, Edge) block JavaScript from issuing TRACE requests, which substantially limits exploitability. However: (1) automated PCI DSS ASV scanners universally flag TRACE as a finding, which will block QSA certification until remediated; (2) older or non-standard HTTP clients are not subject to browser restrictions; (3) the presence of TRACE indicates that HTTP verb filtering is not applied, which is a defense posture gap.

Remediation: Disable the TRACE method in Kestrel/IIS. For Kestrel, add middleware to return 405 Method Not Allowed for TRACE requests. For IIS, set <verbs allowUnlisted="false"> in requestFiltering and omit TRACE from the allowed list. Verify with: curl -X TRACE https://www.travelpro365.com/; expected response after remediation: 405 Method Not Allowed.

8. Privacy and Compliance Status

8.1 California Consumer Privacy Act (CCPA) / CPRA

Status: NON-COMPLIANT (Multiple Confirmed Violations)

Requirement	Status	Finding	Fine Precedent
Privacy policy with required disclosures (§1798.135(a)(2))	❌ ABSENT	PRIVACY-001	Sephora $1.2M
"Do Not Sell or Share" link (§1798.135(a)(1))	❌ ABSENT	PRIVACY-002	Sephora $1.2M
GPC signal honored (§1798.135(b) / CPRA)	❌ 404	PRIVACY-002	Sephora $1.2M
Disclosure of third-party data sharing (§1798.100(a))	❌ None	COMPLIANCE-011	DoorDash $375K
DSAR mechanism (§1798.130(a)(1))	❌ Absent	COMPLIANCE-012	N/A
CalOPPA conspicuous privacy policy	❌ Absent	PRIVACY-001	$2,500–$7,500/violation

The California AG has explicitly stated the travel sector is an enforcement priority. Coastline Travel Group's CST# (2040360-40) identifies it as a California-registered seller of travel, placing it squarely within the AG's jurisdiction.

8.2 General Data Protection Regulation (GDPR)

Status: NON-COMPLIANT (if serving EU residents)

Requirement	Status	Finding
Privacy notice at collection point (Art. 13)	❌ Absent	PRIVACY-001
Lawful basis for processing (Art. 6)	❌ No consent	COMPLIANCE-013
Cookie consent mechanism (Art. 7)	❌ None	COMPLIANCE-013
Privacy by design (Art. 25)	❌ Not implemented	COMPLIANCE-016
Adequate technical security (Art. 32)	❌ Multiple failures	COMPLIANCE-015
International data transfer safeguards (Art. 44-49)	❌ Unknown	COMPLIANCE-017

Fine precedents: Google Analytics CNIL €150M, Meta €60M, Booking.com €475K, Marriott £18.4M, British Airways £20M.

8.3 PCI DSS v4.0.1

Status: FAILING (Multiple Mandatory Requirements Unmet)

Requirement	Status	Finding
Req 1.3.1: Network access controls	❌ RDP open	RECON-003
Req 4.2.1: Strong encryption in transit	❌ Expired cert, weak HSTS	TLS-001, TLS-005
Req 6.2.4: No error detail disclosure	❌ Stack traces in 500 errors	RECON-004
Req 6.3.3: Current software with patches	❌ CVEs unpatched	THREAT-001
Req 6.4.1: WAF for public-facing apps	❌ No WAF	INFRA-001
Req 6.4.3: CSP on payment pages	❌ No CSP	HEADERS-002
Req 8.3: API credential management	❌ Keys in source	SOURCE-001
CORS on payment domain (Req 6.4.3)	❌ Wildcard reflection	HEADERS-001

Note on PCI DSS Req 6.4.1: The WAF requirement became mandatory for all merchants on March 31, 2025. The platform has been out of compliance for approximately 11 months. Fine precedents: Wyndham $10.9M (FTC enforcement for PCI violations), Heartland $145M (breach + PCI non-compliance), British Airways £20M.

8.4 ADA Title III: Web Accessibility

Status: NON-COMPLIANT (No Accessibility Statement)

The DOJ issued a final rule on April 24, 2024 establishing WCAG 2.1 AA as the accessibility standard for Title II entities and extending Title III guidance. No accessibility statement was found on travelpro365.com. A travel booking platform that is inaccessible to persons with disabilities exposes Coastline Travel Group to DOJ civil penalties of $75,000 for a first violation and $150,000 for subsequent violations, plus private litigation. (Finding: COMPLIANCE-018)

8.5 FTC Act §5

Status: EXPOSURE (Deceptive and Unfair Trade Practices)

The FTC Act §5 prohibits "unfair or deceptive acts or practices in or affecting commerce." Two confirmed violations:

COMPLIANCE-023 (Critical): HotJar session recording deployed without any consumer disclosure. Civil penalties up to $51,744 per violation per day under 15 U.S.C. § 45(m)(1)(A) (2023 adjusted amount). FTC precedents: CafePress $500K, Meta $5B.
COMPLIANCE-024 (High): Collecting and transmitting sensitive personal and payment data while operating with critical-tier security vulnerabilities constitutes an "unfair practice" under FTC §5. This mirrors the exact theory of the Wyndham Hotels enforcement action ($10.9M).

9. Infrastructure Risk Assessment

9.1 Network Architecture

The current architecture places the production application server in maximum exposure:

Internet → [No WAF/CDN] → EC2 52.9.246.155 → Kestrel (ASP.NET Core)
                                            → Port 3389 (RDP — OPEN)
                                            → Port 80 (HTTP — OPEN)
                                            → Port 443 (HTTPS — OPEN)

The recommended architecture:

Internet → Cloudflare/WAF → [WAF-only origin IP rules] → EC2
                                                       → No direct public access
                                                       → RDP via VPN/SSM only

9.2 Single Point of Failure

The entire platform runs on a single EC2 instance with no load balancer, no auto-scaling group, and no high-availability configuration. A single hardware failure, a successful DDoS attack, or a ransomware infection would take the entire platform offline with no automatic failover. SOC 2 Availability criteria A1.2/A1.3 require business continuity and disaster recovery planning. Neither was found. (INFRA-007, COMPLIANCE-022)

9.3 Subdomain Exposure Summary

Subdomain	TLS Status	WAF	Risk
travelpro365.com	Valid, expires ~2026+	None	HIGH
www.travelpro365.com	Assumed same as root	None	HIGH
pay.travelpro365.com	GoDaddy cert (hostname mismatch), no HSTS	None	CRITICAL
mvt.travelpro365.com	Expires 12 days, no HSTS	None	CRITICAL
brownell.travelpro365.com	EXPIRED 65+ days	None	CRITICAL

9.4 Threat Actor Landscape

The travel sector faces specific, documented threat actor attention:

Scattered Spider (UNC3944): FBI/CISA advisory AA23-320A specifically calls out this threat group's targeting of travel and hospitality. Tactics include social engineering, MFA fatigue attacks, and SIM swapping for initial access. An exposed RDP port significantly amplifies risk.
Magecart: Magecart-style formjacking attacks against travel booking platforms increased 34% in 2024. The absence of a CSP and the presence of inline scripts create direct Magecart injection risk.
LockBit / BlackCat / Cl0p Ransomware: All three groups have published travel sector victims. Exposed RDP is the primary vector. Average ransomware payment in the travel sector exceeded $800,000 in 2024.

10. Remediation Roadmap

Prioritized remediation actions ordered by criticality, effort, and regulatory exposure.

Finding ID	Title	Severity	Effort	Priority	Owner	Timeline
RECON-003/THREAT-002	Close RDP port 3389	CRITICAL	Low	P0	DevOps	Same day
THREAT-001/003	Patch .NET to 8.0.21+	CRITICAL	Low	P0	DevOps	72 hours
HEADERS-001	Fix CORS on pay subdomain	CRITICAL	Low	P0	Dev	24 hours
THREAT-004	Patch Microsoft-HTTPAPI/2.0 (Windows)	CRITICAL	Medium	P0	DevOps	24 hours
TLS-001	Renew/decommission brownell cert	CRITICAL	Low	P0	DevOps	Same day
INFRA-001/COMPLIANCE-003	Deploy WAF/CDN (Cloudflare)	CRITICAL	Medium	P0	DevOps	48 hours
COMPLIANCE-013/023	Disable HotJar; deploy CMP	CRITICAL	Medium	P1	Dev/Legal	1 week
PRIVACY-001	Publish privacy policy	CRITICAL	Medium	P1	Legal	2 weeks
PRIVACY-002	Add DNSMPI link, implement GPC	CRITICAL	Low-Med	P1	Dev/Legal	2 weeks
TLS-002	Renew mvt cert immediately	HIGH	Low	P1	DevOps	48 hours
TLS-003	Add HSTS to mvt subdomain	HIGH	Low	P1	DevOps	1 week
HEADERS-002	Implement Content-Security-Policy	HIGH	High	P1	Dev	3 weeks
HEADERS-003	Add X-Frame-Options to booking pages	HIGH	Low	P1	Dev	1 week
HEADERS-004	Add X-Content-Type-Options: nosniff	HIGH	Low	P1	Dev	1 week
HEADERS-005	Add Secure flag to antiforgery cookie	HIGH	Low	P1	Dev	1 week
RECON-004	Disable stack traces in production	HIGH	Low	P1	Dev	1 week
SOURCE-001	Restrict/rotate Google Maps API key	HIGH	Low	P1	Dev	1 week
INFRA-002	Restrict EC2 SG after WAF deployment	HIGH	Low	P2	DevOps	After WAF
THREAT-009	CVE-2025-24070 patch (same as THREAT-001)	HIGH	Low	P1	DevOps	72 hours
COMPLIANCE-018	Publish accessibility statement	HIGH	Medium	P2	Legal/Dev	3 weeks
COMPLIANCE-012	Implement DSAR mechanism	HIGH	Medium	P2	Legal	4 weeks
TLS-005	Increase HSTS max-age, add includeSubDomains	MEDIUM	Low	P2	DevOps	2 weeks
TLS-004	Add CAA DNS records	MEDIUM	Low	P2	DevOps	1 week
RECON-006	Enable DNSSEC	MEDIUM	Medium	P3	DevOps	4 weeks
INFRA-007	Add ALB + auto-scaling for HA	MEDIUM	High	P3	DevOps	6 weeks
RECON-011	Add SPF + DMARC DNS records	HIGH	Low	P1	DevOps	24–48 hours
SOURCE-006	Migrate Aid tokens to AES-GCM + reject tampered input	HIGH	Medium	P1	Dev	2–3 weeks
SOURCE-007	Add Aid= format validation; code review for unsafe reflection	MEDIUM	Low	P2	Dev	1 week
SOURCE-002/003	Update jQuery; audit Hotel.js XSS	MEDIUM	Medium	P2	Dev	3 weeks
THREAT-005	Replace jsPDF debug with production build	MEDIUM	Low	P2	Dev	2 weeks
HEADERS-006/007	Add Referrer-Policy, Permissions-Policy	MEDIUM	Low	P2	Dev	1 week
COMPLIANCE-002	Verify cipher suites (RC4/3DES check)	MEDIUM	Low	P2	DevOps	1 week
TLS-007	Plan migration to 3072-bit RSA keys	LOW	Medium	P3	DevOps	Before 2030
HEADERS-009	Suppress Server header	LOW	Low	P3	DevOps	4 weeks
INFRA-006	Obfuscate reverse DNS hostname	LOW	Low	P3	DevOps	4 weeks
INFRA-010	Disable HTTP TRACE method (PCI ASV requirement)	LOW	Low	P2	DevOps	1 week

P0 = Emergency, begin immediately. P1 = This sprint. P2 = Next sprint. P3 = Backlog with defined deadline.

11. Appendix

A. Confirmed Positive Controls

The following security controls are correctly implemented and were credited in the risk score calculation:

TLS 1.0 and 1.1 Disabled: Confirmed. Only TLS 1.2 and 1.3 are supported. This is a compliance requirement under PCI DSS v4.0 and is correctly implemented.
OCSP Stapling Active: Confirmed on travelpro365.com and mvt.travelpro365.com. Reduces latency and improves certificate revocation checking reliability.
Certificate Transparency Logging: 36 CT log entries confirmed. Enables detection of unauthorized certificate issuance.
reCAPTCHA v2 on Login: Bot mitigation present on the authentication endpoint.
No Admin Paths Exposed: /admin, /.git/config, /swagger all return 404. No directory listing or admin console accessible.
Non-Standard Ports Filtered: Most non-standard service ports are filtered. Exception: TCP 3389 (RDP) is confirmed open; this is the most critical finding in the report.

B. Evidence Reference Index

Evidence Item	Method	Result
Primary IP resolution	`dig +short travelpro365.com`	52.9.246.155
WAF absence	`curl -sI` header grep	No cf-ray, x-cache, via headers
Server identification	`curl -sI`	`server: Kestrel`
HSTS value	`curl -sI \`	grep strict	`strict-transport-security: max-age=2592000`
Antiforgery cookie	Response header capture	Secure flag absent
CORS misconfiguration	`curl OPTIONS -H 'Origin: https://evil.com'`	Origin reflected with credentials
brownell cert status	`openssl s_client`	No peer certificate available
mvt cert expiry	`openssl x509 -noout -dates`	notAfter=Mar 16 23:59:59 2026 GMT
RDP port status	TCP port scan (RECON/THREAT)	Port 3389 OPEN
GPC endpoint	`GET /.well-known/gpc.json`	404 Not Found
Privacy policy URLs	HTTP GET (multiple paths)	All 404
HotJar presence	Page source analysis	`static.hotjar.com/c/hotjar-*.js`
Stripe key	Page source analysis	Live publishable key present
Maps API key	Page source analysis	`AIzaSyDbHiYtx66hN9rq4yTwI0QKUfbJFaEHrh4`
EC2 direct IP response	`curl -sk http://52.9.246.155/`	404 (confirms direct response)
Reverse DNS	`dig -x 52.9.246.155`	ec2-52-9-246-155.us-west-1.compute.amazonaws.com
SPF record check	`dig TXT travelpro365.com +short`	Only Google Site Verification; no v=spf1 record
DMARC record check	`dig TXT _dmarc.travelpro365.com`	NXDOMAIN (subdomain does not exist)
Aid token tampering	`curl SearchHotel?Aid=AAAAAAAA`	HTTP 200 OK (no validation error)
HTTP TRACE method	`curl -X TRACE https://www.travelpro365.com/`	HTTP 200 OK (method enabled)

C. CVE Reference Table

CVE	CVSS	Component	Status	CISA KEV
CVE-2024-35264	Critical	ASP.NET Core Kestrel (≤8.0.6)	Unverified patch status	No
CVE-2024-38229	Critical	ASP.NET Core Kestrel (≤8.0.8)	Unverified patch status	No
CVE-2025-55315	Critical	ASP.NET Core (≤8.0.20)	Unverified patch status	No
CVE-2025-24070	High	ASP.NET Core (8.0, 9.0)	Unverified patch status	No
CVE-2021-31166	9.8	Microsoft-HTTPAPI/2.0	Unverified patch status	✓ Yes
CVE-2015-1635	10.0	Microsoft-HTTPAPI/2.0	Unverified patch status	✓ Yes
CVE-2019-0708	9.8	Windows RDP (BlueKeep)	Unverified patch status	✓ Yes
CVE-2025-68428	High	jsPDF	Present (debug build)	No
CVE-2020-11023	Medium	jQuery 3.x	Present (3.5.1 in use)	✓ Yes
CVE-2023-44487	7.5	HTTP/2 Rapid Reset	Unverified	No

D. Regulatory Enforcement Precedents Referenced

Regulation	Case	Amount	Relevance
CCPA	Sephora (2022)	$1.2M	No opt-out, no GPC: exact pattern match
CCPA	DoorDash (2023)	$375K	Undisclosed data sharing
CCPA	InMarket (2024)	$750K	GPC non-compliance
PCI DSS	Wyndham Hotels	$10.9M	Inadequate security controls
PCI DSS	Heartland Payment	$145M	Breach + PCI non-compliance
PCI DSS	British Airways	£20M	Security failures + data breach
GDPR	Google Analytics CNIL	€150M	Cookie consent
GDPR	Meta CNIL	€60M	Cookie consent
GDPR	Booking.com	€475K	Travel sector: disclosure failures
GDPR	Marriott	£18.4M	Travel sector: security failures
FTC Act §5	Meta	$5B	Deceptive data practices
FTC Act §5	CafePress	$500K	Inadequate security
ADA Title III	DOJ Final Rule (2024)	$75K–$150K/violation	Web accessibility

E. Technical Notes

TLS 1.0 and TLS 1.1, Confirmed Disabled: TLS 1.0 and 1.1 are confirmed DISABLED via direct TLS handshake negotiation at the cipher level. This is a positive control, credited in the risk score. A forced legacy TLS probe (curl --tlsv1.0) did produce an HTTP 307 redirect response, but this was an HTTP-level response issued before TLS version negotiation completed, not evidence of TLS 1.0 support. The finding stands: TLS 1.0 and 1.1 are disabled.

RC4/3DES Cipher Presence, Requires Verification: The assessment confirmed TLS 1.2 and 1.3 are supported, but did not enumerate individual cipher suites at sufficient granularity to confirm or rule out RC4 or 3DES. A dedicated cipher suite scan (testssl.sh --cipher-per-proto) against all subdomains is required to close this item. Until confirmed, it is not counted in the risk score totals. If either cipher is confirmed active, this finding elevates to High or Critical under PCI DSS v4.0.1 Req 4.2.1.

RDP Port 3389, Open and Confirmed: TCP port 3389 is confirmed open via direct TCP connection. HTTP-based network probes are not capable of detecting TCP-only services such as RDP and should not be interpreted as evidence that port 3389 is filtered. The authoritative finding is based on TCP-level confirmation: port 3389 is open to the public internet.

End of Report

Classification: CONFIDENTIAL

Prepared by: CIPHER Security Platform

Audit Date: March 4, 2026

Version: 1.0: Phase 1 Final

Next Review: Phase 2 assessment recommended after P0/P1 remediation items are complete

This report contains security-sensitive information. Distribution should be limited to authorized personnel with a need to know. Legal privilege review recommended before sharing outside Coastline Travel Group.

Web Security Audit Report

travelpro365.com: Phase 1 External Passive Reconnaissance

Table of Contents

1. Executive Summary

What This Means in Plain Language

Estimated Regulatory Exposure

Positive Controls Identified

Recommended Immediate Actions (Before Any Other Work)

2. Scope and Methodology

2.1 Scope

2.2 Methodology

2.3 Technology Stack Identified

3. Finding Summary

3.1 Findings by Testing Module

3.2 Risk Score

4. Critical Findings

RECON-003 / THREAT-002 / COMPLIANCE-004: RDP Port 3389 Publicly Exposed

THREAT-001: Unauthenticated Remote Code Execution: ASP.NET Core Kestrel

THREAT-003: HTTP Request Smuggling: CVE-2025-55315

THREAT-004: Wormable RCE: Microsoft-HTTPAPI/2.0 on mvt Subdomain

HEADERS-001: CORS Wildcard Reflection with Credentials on Payment Domain

Null origin also reflected:

TLS-001: Expired SSL Certificate: brownell.travelpro365.com

CT log evidence:

PRIVACY-001: No Privacy Policy (Complete Absence)

PRIVACY-002: No "Do Not Sell or Share My Personal Information" Mechanism

INFRA-001 / COMPLIANCE-003 / COMPLIANCE-020: No WAF or CDN, Direct EC2 Exposure

COMPLIANCE-013: No Cookie Consent for Tracking Technologies

COMPLIANCE-023: HotJar Session Recording Without Disclosure

5. High Findings

TLS-002: mvt.travelpro365.com Certificate Expires in 12 Days

TLS-003: No HSTS on mvt.travelpro365.com

RECON-004 / COMPLIANCE-005: API Endpoints Returning HTTP 500 with Stack Traces

RECON-007 / PRIVACY-003 / PRIVACY-004: Ad Tracking Without Consent Gate

RECON-008: Stripe Live Publishable Key in Client-Side Source

HEADERS-002: No Content-Security-Policy

HEADERS-003: Missing X-Frame-Options on Booking Entry Page

HEADERS-004: No X-Content-Type-Options

HEADERS-005: Antiforgery Cookie Missing Secure Flag

INFRA-002: Direct EC2 IP Responds on Port 80

THREAT-005: jsPDF Debug Build with Active CVEs

THREAT-006: GoDaddy Multi-Year Breach: Payment Infrastructure at Risk

THREAT-009: ASP.NET Core Elevation of Privilege: CVE-2025-24070

RECON-011: No SPF or DMARC Records: Email Domain Spoofing Enabled

SOURCE-006: Missing Token Authentication: Affiliate Aid Tokens Accept Tampered Input (IDOR / Padding Oracle Risk)

SOURCE-001: Google Maps API Key in Public HTML

6. Medium Findings

7. Low and Informational Findings

8. Privacy and Compliance Status

8.1 California Consumer Privacy Act (CCPA) / CPRA

8.2 General Data Protection Regulation (GDPR)

8.3 PCI DSS v4.0.1

8.4 ADA Title III: Web Accessibility

8.5 FTC Act §5

9. Infrastructure Risk Assessment

9.1 Network Architecture

9.2 Single Point of Failure

9.3 Subdomain Exposure Summary

9.4 Threat Actor Landscape

10. Remediation Roadmap

11. Appendix

A. Confirmed Positive Controls

B. Evidence Reference Index

C. CVE Reference Table

D. Regulatory Enforcement Precedents Referenced

E. Technical Notes