Penetration Test Report (7ASecurity): pentest report wepn

Test Targets:
WEPN Backend
WEPN Mobile apps
WEPN RPI Device
Pentest Report
Client: WEPN
7ASecurity Test Team:
● Abraham Aranguren, MSc.
● Miroslav Štampar, PhD
● Óscar Martínez, MSc.
● Tarunkant Gupta, BTech
7ASecurity
Protect Your Site & Apps From Attackers
sales@7asecurity.com
Pentest Report
INDEX
Introduction 3
Identified Vulnerabilities 5
WPN-01-001 WP1: Leaks via missing Security Screen on Android & iOS (Low) 5
WPN-01-005 WP2: Possible Account Takeover via OTP Bruteforce (Low) 8
WPN-01-006 WP2: Arbitrary Account Takeover via IDOR (Critical) 12
WPN-01-007 WP2: Arbitrary Device Claim via IDOR (Critical) 15
WPN-01-008 WP2: Access to Experiment Results via missing ACL (Low) 17
WPN-01-009 WP2: Arbitrary Experiment Update via IDOR (Medium) 18
WPN-01-012 WP1: PII & Token Access via missing iOS Data Protection (Medium) 20
WPN-01-013 WP1: Possible Phishing via Task Hijacking on Android (Medium) 23
WPN-01-014 WP1: Possible Keychain Data Access via Backups on iOS (Medium)27
WPN-01-018 WP1: PII Access via inadequate KeyStore Usage on Android (Low) 29
WPN-01-023 WP3: Access to RPI Device Local Token via IP Spoofing (Medium) 30
WPN-01-025 WP1/3/4: Possible MitM via disabled TLS Validation (Medium) 35
WPN-01-029 WP2/3/4: Arbitrary Device Claim via Serial Number (Low) 36
Miscellaneous Issues 40
WPN-01-002 WP2: Multiple Vulnerabilities in Backend Libraries (Low) 40
WPN-01-003 WP2: Email Enumeration via API Error Messages (Low) 42
WPN-01-004 WP2: Missing Rate Limiting and Lockout Protection (Medium) 44
WPN-01-010 WP1/2: Possible Takeover via Weak Password Policy (Low) 46
WPN-01-011 WP1: Missing Jailbreak/Root Detection on Android & iOS (Info) 47
WPN-01-015 WP1: Support of Insecure v1 Signature on Android (Info) 48
WPN-01-016 WP1: Possible clear-text MitM via ATS config (Info) 49
WPN-01-017 WP1: Android Hardening Recommendations (Info) 49
WPN-01-019 WP1: Android Binary Hardening Recommendations (Info) 51
WPN-01-020 WP3/4: Possible root Access via Passwordless sudo (Low) 52
WPN-01-021 WP3: Proposed Firewall Rule Enhancements (Low) 55
WPN-01-022 OOS: Possible RPI Device Physical Security Improvements (Info) 57
WPN-01-024 WP4: Usage of unsupported CSP Directives on Main Website (Info) 58
WPN-01-026 WP3/4: Possible Fingerprinting & Blocking via API Exposure (Low) 59
WPN-01-027 WP2: Enumeration of User IDs via Error Messages (Low) 60
WPN-01-028 OOS: Directory Listing Enabled on Repo Subdomain (Info) 61
WPN-01-030 WP2: Missing device_key Bruteforce Protection (Low) 62
WPN-01-031 WP2: Missing Secure flag on sessionid Cookie (Info) 64
Conclusion 66
7ASecurity © 2022
2
Pentest Report
Introduction
“Become your own VPN provider
Provide Uncensored Internet In Minutes To Your Trusted Family And Friends.”
Fromhttps://we-pn.com/
This report outlines the results of a penetration test and whitebox audit conducted
against the WEPN solution. The work was requested by the WEPN maintainers, funded
by the Open Technology Fund program, and carried out by 7ASecurity in March 2022. A
total of 17 days were invested to reach the coverage expected for this project. Please
note that this is the third penetration test for the platform, which follows two audits
performed by Cure53 in 2017 and 2018. Consequently, identification of new security
weaknesses was expected to be more difficult during this engagement, as more
vulnerabilities are identified and resolved after each testing cycle.
During this iteration, the aim was to review not only the security posture of the WEPN
RPI device, Web API and backend (all reviewed in previous audits), but also the WEPN
mobile applications, which were reviewed for the first time during this engagement. The
goal was to review all items in scope as thoroughly as possible to ensure WEPN users
can be provided with the best possible security.
7ASecurity was provided with access to three WEPN RPI devices (one physically, the
others were used remotely via SSH), API documentation, test users for the backend
website used by staff, as well as mobile application builds for both Android and iOS.
The methodology implemented was whitebox: WEPN provided source code for all items
in scope, which helped the 7ASecurity team to review the implementation of all features
more efficiently and in greater depth. This provided WEPN with significantly more value
for money in the time available for this assessment. For example, the root cause
analysis on several identified issues provides the affected files and source code where
possible in this report, as well as mitigation guidance tailored for the platform in use. A
team of 4 senior testers was assigned for the preparation, execution and finalization of
this project.
The project entailed a full audit of all components of the WEPN solution (i.e. backend,
mobile apps, API, device), where all items in scope pointed to a development server
during this assignment. The core goal in scope for this assessment was to verify if the
WEPN solution delivers on its promise to protect users, and suggest how the platform
might be improved in the future in order to become more difficult to attack by malicious
adversaries. This included testing the device and backend APIs, mobile app pairing
7ASecurity © 2022
3
Pentest Report
process with the devices, and other relevant areas with special focus on attack vectors
that could put WEPN users at risk.
Please note that this exercise split the scope items in the following work packages,
which are referenced in the ticket headlines as applicable:
● WP1 - Whitebox Tests against WEPN VPN React Native Android & iOS apps
● WP2 - Whitebox Tests against WEPN VPN Django Backend & Admin Interface
● WP3 - Whitebox Tests against WEPN RPI Device
● WP4 - General Documentation & Consulting
All preparations were done in January and February of 2022, ahead of the test, to
ensure a smooth start for the 7ASecurity team. Communications during the test were
done using a shared Slack channel. The WEPN team was helpful and responsive even
during out-of-office hours.
Communications were smooth and not many questions had to be asked. The scope was
well prepared and clear, with no noteworthy roadblocks encountered during the test.
7ASecurity gave frequent status updates about the test and the related findings.
The team acquired adequate coverage over the scope items and managed to spot a
total of 31 findings, 13 of which were classified as security vulnerabilities and 18 as
general weaknesses with lower exploitation potential. Please note that 2 of the findings
in this report were technically outside of scope (OOS) of the WEPN threat model for this
audit, these are designated with “OOS” in the title.
The report will now shed further light on the scope and test setup as well as the available
material for testing. It will subsequently list all findings in chronological order beginning
with the vulnerabilities found and then the general weaknesses discovered in this test.
Each finding will be accompanied by a technical description, a proof-of-concept (PoC)
where possible, as well as mitigation or fix advice. The report will then close with a
conclusion in which 7ASecurity will elaborate on the general impressions gained
throughout this test and share some views on the perceived security posture of the
scope that is WEPN.
7ASecurity © 2022
4
Pentest Report
Identified Vulnerabilities
The following sections list both vulnerabilities and implementation flaws identified during
the testing period. Please note that findings are listed in chronological order rather than
by their degree of severity and impact. The aforementioned severity rank is simply given
in brackets following the title heading for each vulnerability. Each vulnerability has
additionally been given a unique identifier (e.g. WPN-01-001) for the purpose of
facilitating any future follow-up correspondence.
WPN-01-001 WP1: Leaks via missing Security Screen on Android & iOS (Low)
Retest Notes: Fix verified. The WEPN Team promptly fixed this issue1. 7ASecurity
verified that the