Penetration Test Report (Bugcrowd): Instructure Canvas Security Summary 2015

Instructure’s Canvas
Bugcrowd Flex Program and Retest Results
March 24, 2016
Executive Summary
InstructureengagedBugcrowdInctoperformaFlexBountyProgram(”Flex”),commonlyknownasa
crowd-sourcedpenetrationtest,onInstructure’sCanvas. Testingoccurredduringtheperiod: 11/17/2015–
12/11/2015.
ForthisFlex,56researcherswereinvitedtoparticipate;45acceptedtheinvitation,resultingin138
vulnerabilitysubmissionsreceivedfrom26uniqueresearchers. Theseissuesrangedinscopeandseverity,
with3highpriorityP2issue(s)discovered. Asawhole,researcherswithrewardablesubmissionsreceived
$19,300outofatotalprizepoolof$20,000.
Thisreportisjustasummaryoftheinformationavailable. Youcanfindalldetails–includingvulnerability
remediation–ofyourprogramintheBugcrowdCrowdcontrolTracker: https://tracker.bugcrowd.com. Ifyou
haveanyquestionsorcomments,pleasecontactsupport@bugcrowd.com.
BugcrowdInc–2016 2of8
Methodology
The strength of crowdsourced testing lies in multiple researchers, the pay-for-results model, and the varied
methodologies that the researchers implement. To this end, we encourage researchers to use their own
individualmethodologiesonBugcrowdFlexprograms.
Theworkflowofeverypenetrationtestcanbedividedintofourphases: reconnaissance,enumeration,
exploitationanddocumentation.
•Reconnaissance:
Gatheringinformationbeforetheattack
•Enumeration:
Findingattackvectors
•Exploitation:
Verifyingsecurityweaknesses
•Documentation:
Collectingresults
Bugcrowdresearcherswhoperformwebapplicationtestingandvulnerabilityassessmentusuallysubscribeto
avarietyofmethodologiesfollowingthisworkflow,including: theOWASP4.0TestingGuide,thePenetration
TestersExecutionStandard,andtheWAHHMethodology.
BugcrowdInc–2016 3of8
Priority Key
Thefollowingprioritymatrixisusedasaguidelinetoclassifyvalidassessmentfindings:
Priority Impact ExampleVulnerabilityTypes
P1–Critical Vulnerabilitiesthatcauseaprivilege •RemoteCodeExecution
escalationfromunprivilegedtoadminor •VerticalAuthenticationBypass
allowforremoteexecution,financial •XMLExternalEntitiesInjection
theft,etc. •SQLInjection
•InsecureDirectObjectReferenceforacriticalfunction
P2–High Vulnerabilitiesthataffectthesecurityof •Lateralauthenticationbypass
theplatformincludingtheprocessesit •StoredCross-SiteScripting
supports •Cross-SiteRequestForgeryforacriticalfunction
•InsecureDirectObjectReferenceforanimportantfuntion
•InternalServer-SideRequestForgery
P3–Medium Vulnerabilitiesthataffectmultipleusers •ReflectedCross-SiteScriptingwithlimitedimpact
andrequirelittleornouserinteraction •Cross-SiteRequestForgeryforanimportantfuction
totrigger •InsecureDirectObjectReferenceforanunimportantfuction
•URLredirect
P4–Low Vulnerabilitiesthataffectsingularusers •Cross-SiteScriptingwithlimitedimpact
andrequireinteractionorsignificant •Cross-SiteRequestForgeryforanunimportantfunction
prerequisitestotrigger(MitM)totrigger •ExternalServer-SideRequestForgery
BugcrowdInc–2016 4of8
Flex Bounty Program Overview
AFlexisanovelapproachtoanapplicationassessmentor
penetrationtest. Traditionalpenetrationtestsuseonlyoneortwo
researcherstotestanentireapplication,whileFlexesleveragea
crowdofsecurityresearchers. Thisincreasestheprobabilityof
discoveringesotericissuesthatautomatedtestingcannotfind
andthattraditionalvulnerabilityassessmentsmaymiss,inthe
sametestingperiod.
TheFlexforInstructure’sCanvasreceivedsubmissionsfrom26
researchersinthefollowingcountries: Afghanistan,Brazil,
Canada,India,Ireland,Morocco,Netherlands,Philippines,
Portugal,Romania,Spain,Turkey,UnitedKingdom,andthe
UnitedStates. MostoftheresearchersarebasedinIndia.
Atotalof138submissionswerereceived,with10
uniquevalidissuesdiscovered. Bugcrowd
identified78duplicateand28won’tfix
submission(s),andremoved22invalid
submission(s).
ThetimelinebelowshowssubmissionsreceivedandvalidatedbytheBugcrowdteam:
BugcrowdInc–2016 5of8
Bugcrowdranksthetechnicalpriorityofall
confirmedfindingsonascalefromP1(Critical)to
P4(Low). Theresultsareshowntotheright. The
majorityofsubmissionstotheInstructure’s
CanvasFlexwereP4.
AcomparisonofBugcrowd’sotherflexestothetheInstructure’sCanvasFlexisshownbelow.
BugcrowdInc–2016 6of8
All Valid Submissions
Title ReferenceNumber Priority Reward Retest
StoredXSSviaGroups de61564ce42f9e9013c100f14 2 $6,000.00 Resolved
031da9392d5f60b081a886f0
c0ce605af56d7a0
StoredXSSviaOutcomes 7391ca90e0fdf157143b12e0 2 $4,000.00 Resolved
c602aa14a03d21e6ec129f80
171ab9dcc1ed3284
StoredXSSinQuizQuestionBankas 1fd8f1db7cbd2a8d6076802b 2 $3,000.00 Resolved
Teacher 40cb8993438cea6cdd93b7c2
b6440d8ab1ca7c19
PrivilegeescalationviaIDOR: e31b26d4fe28dc894b4d7a11 4 $500.00 Resolved
Changethebehalfofanotheruser 6523f6b69387cc397cd63fff4
AllNotificationPreferences 466ed38cbfd0b75
ContentSpoofing(iframeInjectionvia f224e7c58b711457bb73610d 3 $200.00 Resolved
HTMLEditor) 7853a5c5f27e25cfc7e43de2b
220155a5dcb391e
UseraccountinformationIDORat 7d2e91c088b03ebc71ee3350 3 $200.00 Resolved
/users/<user id> 4832ebe572ecd8f84bc827e9
e67cdffaf304e7ac
CSVInjection(GradebookExport) 8944ad7281953f597cf6091b 4 $200.00 Resolved
ecbeba36fbfda5dcddb74594
7c4ccfd14e172e1b
CoursePageIDOR 90332ea307577359de9d50b 4 $200.00 Resolved
47e0b97a112f50c26b664641
6c4920017bbed518b
ExternalAuthenticationInjectionvia d8989daebdedcacaf512bf13 4 $200.00 Unresolved
HTMLEditor 12bfe1d9cfd44979359a833a
58dda704a1012885
WindowOpenerPropertyBugviaHTML 3d253e7e68775ab8e17b8dfb 4 $200.00 Resolved
Editor ca01d417fe5d59f1ca264f2ce
933fb5c5541c8e3
BugcrowdInc–2016 7of8
Document History
• March24,2016–DocumentCreated
BugcrowdInc–2016 8of8