Penetration Test Report (Bugcrowd): Instructure Canvas Security Summary 2014

CANVAS by Instructure
Bugcrowd Flex Program Results
December 2014
Executive Summary
Bugcrowd Inc was engaged by Instructure to perform a Flex Bounty program, commonly known
as a crowdsourced penetration test, on the CANVAS infrastructure and source code. The testing
was performed between October 08 – 22, 2014.
During the test, 322 submissions were received from 63 unique testers. From these
submissions, 59 unique security issues were identified over the course of the two week testing
window on the Instructure CANVAS staging environment. These issues ranged in scope and
severity, with no critical issues discovered. The primary finding was a prevalence of Stored XSS
vulnerabilities, which have now been remediated by the Instructure team.
While there were a large number of issues found in comparison with previous tests run against
the CANVAS infrastructure, this is expected with a Bugcrowd Flex Bounty. On average, 73
findings are found and reproduced in programs against applications of similar size and scope.
The Flex Bounty program for CANVAS produced 59 findings, a significantly lower number
compared to other programs.
Given data collected while performing Flex Bounty programs for organizations of similar size
and scope, it is Bugcrowd’s assessment that the CANVAS application was designed and
developed by engineers who possess an understanding of best practices. The security team’s
vulnerability response during and after the program was organized and well thought out. Based
on our experience working on bounty programs, the Instructure team takes security seriously.
Flex Bounty Program Overview
A Flex Bounty program is a novel approach to an application assessment or penetration test.
Traditional penetration tests use only one or two researchers, resulting in less overall testing of
the application. Bugcrowd researchers routinely
examine applications and discover many esoteric
issues that automated testing cannot find and that
traditional vulnerability assessments routinely miss.
The Flex Bounty program for CANVAS had 63
invited researchers testing the application, from an
array of countries around the world.
59 valid
and reproducible issues were identified out of 322
total submitted issues. Bugcrowd cleaned all data,
removing ignored, invalid, and duplicate issues.
Bugcrowd Inc - 2014 Page 2 of 7
To the left, the timeline
demonstrates submissions
received, validated, and
then finally resolved during
the program by the
Instructure team. In
combination with the lack of
critical findings, it is this
final step, resolution, that
indicates a mature security
program for CANVAS.
Bugcrowd ranks the technical priority of all confirmed findings on a
scale from 1 (critical) to 5 (accepted risk). The results can be
found to the right. There were no critical issues identified.
The comparison of this program to other Flex Bounty programs on
Bugcrowd’s platform is below. The stored XSS findings make the
Priority 2 ratio slightly higher than other programs but there were
no priority 1 issues found and fewer overall findings (59 vs. 73 in
other comparable programs)
Above, the overall finding types are compared with other programs of similar size and scope.
Bugcrowd Inc - 2014 Page 3 of 7
Valid submissions on this program averaged a $162.75 payout, with the maximum payout being
$2000. A total of $8300 was paid out during the course of the two-week program.
Priority Key
The following priority matrix was used to classify the Instructure CANVAS assessment findings.
Priority Common Description Examples
Level Name
P1 Critical Vulnerabilities that affect all users of the platform, and Remote code execution
/ or affect the security of the platform or host Vertical authentication
system(s). bypass
SSRF
XXE
SQL injection
P2 High Vulnerabilities that affect more than one user of the Stored XSS
platform, and that require little or no user interaction Direct object reference
to trigger. User authentication
bypass
P3 Medium Vulnerabilities that affect more than one user, but may Open Redirect,
also require interaction or a specific configuration. Reflected XSS,
CSRF
P4 Low Issues that affect singular users and require Common flaws, Debug
interaction or significant prereqs (MitM) to trigger. information, Host
Header
Bugcrowd Inc - 2014 Page 4 of 7
Findings Summary Matrix
FFiinnddiinngg NNaammee Priority Finding Status Instructure Response
3 stored xss in discussions 2 Resolved Fixed.
3 stored xss in same place (teacher Resolved Previously fixed in
2
account in syllabus area) production.
Content Spoofing on uploadify.swf Resolved Upgraded to latest version,
2
fixed.
CSRF in email addition 2 Resolved Ultimately a false positive.
Flash Based Cross Site Scripting Resolved Fixed. Only reproducible in
2
(Flash exploit) the test environment.
Flash XSS at rapid7- Resolved Fixed.
tc.instructure.com/ Filename: 2
FileAPI.flash.image.swf
Open Direct and XSS at https:// Resolved Ultimately, no sensitive data
rapid7-tc.instructure.com/images/ can be exposed by this XSS.
2
users/1?fallback=http://
www.bugcrowd.com/
Quiz IP Filter bypass Resolved Fixed. Only reproducible in
2
the test environment.
Reflected xss 2 Resolved Fixed.
stored cross-site-scripting in https:// Resolved Fixed. Only reproducible in
rapid7-tc.instructure.com/ 2 the test environment.
eportfolios/19/Home/Welcome
stored in files upload Resolved Fixed. Only reproducible in
2
the test environment.
stored xss 2 Resolved Fixed.
stored xss 2 Resolved Fixed.
Stored xss 2 Resolved Fixed.
Stored XSS 2 Resolved Fixed.
Stored XSS 2 Resolved Fixed.
Stored XSS - Calendar undated Resolved Fixed (same underlying
2
items issue).
stored xss in calendar title 2 Resolved Fixed.
Stored XSS in filename in Tooltip of Resolved Fixed.
2
Calendar Events
stored xss in https://rapid7- Resolved Fixed. Only reproducible in
2
tc.instructure.com/dashboard/files the test environment.
Bugcrowd Inc - 2014 Page 5 of 7
Finding Name Priority Finding Status Instructure Response
Stored XSS - Possible answer Resolved Fixed. Only reproducible in
2
Quizzes the test environment.
xss 2 Resolved Fixed.
XSS Resolved Not a viable attack vector
2 (Self-XSS). Plan to fix
anyway.
Xss in Enrollment 2 Resolved Fixed.
xss in https://rapid7- Resolved Fixed.
2
tc.instructure.com/
Xss in Import Content 2 Resolved Fixed.
XSS via File Upload SWF Resolved Fixed. Only reproducible in
2
the test environment.
Assigning more than prescribed Resolved Not a security bug. Fixed.
students in a group Group limits are respected
3
when students are randomly
assigned.
Failure to Restrict URL Access Resolved Ultimately not a viable attack
3 vector. Complexity of brute
force protection is sufficient.
Forced Browsing by teachers to Resolved Working as intended.
3
access unauthorized groups
No rate limiting on conversation Resolved Rate limiting being added.
3
messages
Sending messages for Resolved Fixed.
3
unsubscribed courses
Sending messages from Resolved Fixed.
3
unsubscribed groups
Unauthorized access to Resolved Ultimately not a viable attack
announcements 3 vector. Complexity of brute
force protection is sufficient.
Xss in Quiz Resolved Fixed. Only reproducible in
3
the test environment.
Accepting Old Password As New Resolved Fixed. Only reproducible in
Password the test environment. Best
4
practice for OSS version
updated.
Encrypted Cookie Store Resolved Updated cookie store gem.
4
malleability / Key-reuse Fixed in next release.
Force-Login CSRF on CANVAS 4 Resolved Fixed.
Bugcrowd Inc - 2014 Page 6 of 7
Finding Name Priority Finding Status Instructure Response
Host header attack Resolved Fixed. Only reproducible in
4
the test environment.
X-Forwarded-Host Host header Resolved Fixed. Only reproducible in
4
Attack the test environment.
Missing DNSSEC 4 Resolved Not a viable attack vector.
No rate limitation on email Resolved Not a viable attack vector.
4
confirmation
No validation on add email function Resolved Fixed.
4
(POST /communication_channels)
Password Complexity very low. Res