Penetration Test Report (Randorisec): randorisec pentest report thehive v1 0 tlp white

PENTEST REPORT
TLP:WHITE
This report is classified TLP:WHITE. TLP:WHITE is information that is for public, unrestricted
dissemination, publication, web-posting or broadcast. Any member of the Information Exchange may
publish the information, subject to copyright.
© RANDORISEC - 2017 Version 1.0 – March 28, 2017 c
TheHive Pentest Report
1. Executive Summary
TheHive1 is a free and open-source security incident response platform. It relies on Cortex2 to analyze
observables (IP, email addresses, domain names, etc…). Both tools were designed and developed by
TheHive Project3.
A penetration test, which followed the WAHH4 methodology, was performed by RANDORISEC to assess
the security level of the platform. We tested TheHive Buckfast 0 (version 2.10.0) and Cortex version
1.0.0.
Positive Points
We were unable to access the web application anonymously. We were also unable to elevate our
privileges without resorting to social engineering tricks.
Negative Points
We have identified a critical vulnerability (Stored Cross-Site Scripting) along with a few less critical ones
(Reflected Cross-Site Scripting, Vertical privilege escalation, Concurrent session allowed, No account
lockout policy, No password policy, Information leakage and Cross-Site Request Forgery).
By exploiting these vulnerabilities, an attacker could trick users into executing malicious code in their
browsers and/or computers or try to brute-force the authentication mechanism. This could lead to
illegitimate access or privilege escalation. The only critical vulnerability we found does not come
directly from TheHive code but from a dependency. The developers have been made aware of the
vulnerabilities prior to the publication of this report according to the responsible disclosure policy5.
They assured RANDORISEC that most if not all vulnerabilities would be fixed in Buckfast 2 (version
2.10.2), due in April 2017.
We also found some low severity vulnerabilities. They are mainly located in the access part (session
handling and authentication) and should not be very challenging to fix.
1 https://github.com/CERT-BDF/TheHive
2 https://github.com/CERT-BDF/Cortex
3 https://thehive-project.org/
4 Web Application Hacker’s Handbook.
5 https://vuls.cert.org/confluence/pages/viewpage.action?pageId=4718642
CLASSIFICATION : PUBLIC / TLP : WHITE Page 1 of 20 c
TheHive Pentest Report
Content
1. Executive Summary _______________________________________________________________ 1
1. Introduction ____________________________________________________________________ 3
2. Vulnerabilities ___________________________________________________________________ 5
3. Recommendations _______________________________________________________________ 7
4. Detailed findings _________________________________________________________________ 9
5. Appendices ____________________________________________________________________ 18
CLASSIFICATION : PUBLIC / TLP : WHITE Page 2 of 20 c
TheHive Pentest Report
1. Introduction
1.1. Test Period and Duration
The pentest was performed in 4 man-days spanning several weeks starting from February 9, 2017 and
ending on March 21, 2017.
1.2. Credits
RANDORISEC and Davy Douhine, the company’s CEO, would like to thank the following professionals,
listed in alphabetical order, for their help performing the pentest described in this report:
- Frédéric Cikala
- Nicolas Mattiocco
- Florent Montel
- Mohamed Mrabah
- Maximilano Soler
Important Note
RANDORISEC and the pentesting professionals that joined it for this pentest have no contract with
TheHive Project and did not receive any compensation of any sort to perform this pentest.
RANDORISEC and the pentesting professionals listed above performed this work on their free time
as a way to contribute to the security of Free, Open Source Software projects.
1.3. Perimeter and Methodology
1.3.1. Target
TheHive and Cortex applications were installed using the public Docker versions, following the
instructions provided at the following location:
https://github.com/CERT-BDF/TheHive/wiki/Docker-guide---TheHive-Cortex
We performed our tests on TheHive Buckfast 0 (version 2.10.0) and on Cortex 1.0.0:
CLASSIFICATION : PUBLIC / TLP : WHITE Page 3 of 20 c
TheHive Pentest Report
1.3.2. Restric@ons
No restrictions were made.
1.3.3. Test cases
As the mission we took upon ourselves was a pentest and not an audit, this report contains only the
vulnerabilities that were found. However, all the main areas that were checked are listed in the
appendices at the end of this document.
1.4. Confidentiality
This report and its appendices are classified TLP:WHITE according to Trusted Introducer’s ISTLP v1.16.
6 https://www.trusted-introducer.org/ISTLPv11.pdf
CLASSIFICATION : PUBLIC / TLP : WHITE Page 4 of 20 c
TheHive Pentest Report
2. Vulnerabilities
Severity levels result from the combination of their impact with their probability of occurrence, which is quantified according to the following scale: Low (L)
– yellow / Medium (M) – orange/ High (H) – red.
Note: Only proven or very plausible vulnerabilities are listed. When the tests were not able to highlight significant security holes, those will not be mentioned
(unless the test was explicitly part of the request).
CLASSIFICATION : PUBLIC / TLP : WHITE Page 5 of 20 c
.feR
Title Target(s) Description Risk(s) Severity level
Malicious JavaScript code can be injected. It will be then executed on
AP.1 Stored XSS TheHive User impersonation H
the victim’s browser.
Malicious JavaScript code can be injected. It will be then executed on
AP.2 Reflected XSS TheHive User impersonation L
the victim’s browser.
Cortex
Vertical privilege Facilitates session
AP.3 TheHive An authenticated simple user can have access to some admin menus. L
escalation usurpation
Concurrent sessions Facilitates session
AP.4 TheHive Concurrent sessions are allowed for a single user. L
allowed usurpation
No account lockout Facilitates user
AP.5 TheHive Authentication system can be brute-forced. L
policy impersonation
As no password policy is enforced when using the local database for
Facilitates user
AP.6 No password policy TheHive storing user credentials, users can set weak passwords (e.g.: L
impersonation
containing only one character).
TheHive Pentest Report
CLASSIFICATION : PUBLIC / TLP : WHITE Page 6 of 20 c
.feR
Title Target(s) Description Risk(s) Severity level
Information such as installed software versions (TheHive,
AP.7 Information leakage TheHive Sensitive info leak L
ElasticSearch) is publically available.
As no anti-CSRF tokens are used, TheHive is vulnerable to CSRF
AP.8 CSRF Illegitimate access L
TheHive attacks.
TheHive Pentest Report
3. Recommendations
CLASSIFICATION : PUBLIC / TLP : WHITE Page 7 of 20 c
noitcA
.feR
Severity Target(s) Improvement Suggestions Difficulty
1 AP.1 H TheHive If possible, use a white list at the application level by defining the expected characters rather 3
AP.2 Cortex than refusing the dangerous ones.
If that’s not a possibility, the application should filter meta-characters from user input. When
performing input validation, consider all potentially relevant properties, including length, type
of input, the full range of acceptable values, missing or extra inputs, syntax, and consistency
across related fields, and conformance to business rules.
2 AP.3 L TheHive Deny access to admin pages to non-admin users. 2
3 AP.4 L TheHive Only allow one session per user at any given time. 2
4 AP.5 L TheHive Enforce an account lockout policy. 2
5 AP.6 L TheHive Implement a password policy or use LDAP or AD authentication and ensure your LDAP/AP 2
enforces a password policy.
TheHive Pentest Report
CLASSIFICATION : PUBLIC / TLP : WHITE Page 8 of 20 c
noitcA
.feR
Severity Target(s) Improvement Suggestions Difficulty
6 AP.7 L TheHive Deny access to potentially sensitive information to anonymous, non-authenticated users. 2
7 AP.8 L TheHive Implement anti-CSRF tokens. 2
TheHive Pentest Report
4. Detailed findings
4.1. AP.1 - Stored XSS
TheHive is vulnera