Penetration Test Report (Pentest-Limited): Report URI   2020 Penetration Test Report

REPORT-URI
R1973
Report URI - Application
and API Assessment
02/12/2020
26a The Downs, Altrincham, Cheshire, WA14 2PU
Tel: +44 (0)[PII_REDACTED]
www.pentest.co.uk
Author: Dawid Golunski
COPYRIGHT PENTEST LIMITED 2019. ALL RIGHTS RESERVED. NO PART OF THIS PUBLICATION MAY BE REPRODUCED, STORED
IN A RETRIEVAL SYSTEM, OR TRANSMITTED IN ANY FORM, OR BY ANY MEANS, ELECTRONIC, MECHANICAL, PHOTOCOPYING,
RECORDING OR OTHERWISE, WITHOUT THE PRIOR WRITTEN PERMISSION OF THE COPYRIGHT HOLDER.
Table of Contents
1 Document Revision History.................................................................................................... 3
2 Introduction ............................................................................................................................ 4
2.1 Scope & Duration ................................................................................................................ 4
2.2 Scenarios Included ............................................................................................................. 4
2.3 Target(s) .............................................................................................................................. 4
3 Executive Summary ............................................................................................................... 5
3.1 Next Steps ........................................................................................................................... 5
3.2 Caveats ............................................................................................................................... 6
3.3 Risk Categories & Rationales ............................................................................................. 7
3.4 Equivalency with CVSS ...................................................................................................... 7
3.5 Visual Summary .................................................................................................................. 8
4 Recommended Actions .......................................................................................................... 9
5 Technical Findings ............................................................................................................... 10
5.1 Cross-Site Scripting .......................................................................................................... 11
5.2 Server Side Request Forgery (SSRF) .............................................................................. 14
5.3 Denial of Service for Network Services ............................................................................ 16
5.4 Outdated Software Detected ............................................................................................. 18
5.5 Insecure SSL/TLS Cipher Suites ...................................................................................... 20
5.6 Information Exposure through Directory Listing ................................................................ 22
6 Additional Information .......................................................................................................... 23
6.1 WHOIS Database.............................................................................................................. 23
6.2 Port Scan Results ............................................................................................................. 25
6.3 SSL/TLS Assessment ....................................................................................................... 26
Appendix A. SSRF scanner ........................................................................................................... 32
P A GE | 2 CONFIDENTIAL
R1973 - REPORT URI - APPLICATION AND API ASSESSMENT
1 Document Revision History
Name Date Version Comment
Dawid Golunski 30/11/20 0.1 Initial Document
Mark Rowe 01/12/20 0.2 QA by senior consultant.
Dawid Golunski 02/12/20 1.0 Final Draft
P A GE | 3 CONFIDENTIAL
R1973 - REPORT URI - APPLICATION AND API ASSESSMENT
2 Introduction
Report URI was founded to take the pain out of monitoring security policies like CSP and other
modern security features. When you can easily monitor what's happening on your site in real time
you react faster and more efficiently, allowing you to rectify issues without your users ever having to
tell you. The Report URI platform is constantly evolving to help better protect your users
Report URI are the best real-time monitoring platform for cutting edge web standards. Their
experience, focus and exposure allow them to take the hassle out of collecting, processing and
understanding reports, giving you just the information you need.
Report URI have indicated the need for a security test, of their ‘Report URI’ application in order to
identify vulnerabilities to attacks that could be launched across a computer network and to provide
security assurances regarding their systems. Such a test will allow Report URI to undertake
remediation efforts and increase their overall security posture.
2.1 Scope & Duration
This assessment included the following phases of work:
 Phase 1 – Web application assessment of the Report URI application
 Phase 2 – Reporting
The duration included 6 days effort (including reporting). Work commenced on 23/11/2020 and
concluded on 30/11/2020.
2.2 Scenarios Included
The test was performed from a remote attacker’s perspective. Test premium accounts were provided.
Additionally, the web server config files, webroot filelist and the source-code of the application were
also provided to allow for in-depth testing that would be hard to perform otherwise within a limited
time window.
2.3 Target(s)
— report-uri.com
P A GE | 4 CONFIDENTIAL
R1973 - REPORT URI - APPLICATION AND API ASSESSMENT
3 Executive Summary
Pentest performed a remote security assessment of the Report URI application.
The Report URI application performed well under testing. It was apparent that the application was
created with security in mind. The website used Cloudflare web application firewall, it also followed
best security-practices and implemented multiple security controls such as extended web server
security headers.
The most concerning issues found during the assessment were:
— Cross-Site Scripting – Medium – Due to insufficient escaping of user-provided data, a
malicious attacker could attempt to inject malicious scripts within server responses sent to
victim users who visited a malicious attacker’s website. This could allow attackers to gain
access to the victim’s authenticated session. This vulnerability was however mitigated by the
CSP policy in use and would essentially only be exploitable on older browsers which did not
support modern web server headers.
— Server Side Request Forgery (SSRF) – Medium – Several of the provided online
tools/features could be abused by remote unauthenticated attackers to send HTTP/HTTPS
requests to services on the internal network such as the Redis server. The impact of this
vulnerability was however reduced in the current configuration of the services and software
versions in use.
— Denial of Service for Network Services – Medium – Due to excessive timeout, attackers who
controlled a botnet consisting of many machines that could be used for malicious purposes,
could potentially flood the web servers with malicious requests that could consume a large
amount of server resources and potentially lead to a Denial of Service preventing genuine
users from accessing the application.
Several low severity issues were also discovered which mainly pertain to minor server
misconfigurations and unnecessary information exposure.
3.1 Next Steps
A complete writeup of every issue is available in the body of this report. It includes required steps to
confirm and replicate each issue, along with recommended remedial actions. Pentest recommend
taking time to review the findings before arranging a triage meeting to determine the order of priority
for remedial work. As a rule of thumb:
