Penetration Test Report (Securitum): securitum protonmail security audit

Security report
SUBJECT
Penetration testing of beta.protonmail.com, account.protonmail.com and
calendar.protonmail.com web applications, in blackbox and whitebox approach
DATE
22.04.2021 – 14.05.2021
LOCATION
Cracow, Poland
Wroclaw, Poland
AUDITORS
Marek Rzepecki
Piotr Izak
Michał Bentkowski
VERSION
1.0
Executive summary
This document is a summary of work conducted by Securitum. The subject of the tests were the
following web applications:
• https://account.protonmail.com (application responsible for account management)
• https://beta.protonmail.com (core mailbox application)
• https://calendar.protonmail.com (calendar application, used in conjunction with
beta.protonmail.com)
The tests were carried out by using Blackbox and Whitebox approaches. The latter were based on
the publicly available source code, downloaded from the organization’s github.com repository:
• proton-account (version: 4.0.0-beta.13 – 2021-04-21),
• proton-calendar (version: 4.0.0-beta.17 – 2021-04-21),
• proton-contacts (version: 4.0.0-beta23 – 2021-04-21),
• proton-drive (version: 4.0.0-beta.13 – 2021-04-21),
• proton-mail (version: 4.0.0-beta.40 – 2021-04-21),
• react-components (last commit: dd32a97c6c591f52e82e13e502a8fab442cbd283 –
22.04.2021),
• proton-shared (last commit: 74704bf07a0570e0db218f42e0284b3e89177d28 –
22.04.2021).
The most severe vulnerabilities identified during the assessment were:
• Reflected Cross-Site Scripting - possibility to inject JavaScript code into the image attached
to the email
During the tests, particular emphasis was placed on vulnerabilities that might affect confidentiality,
integrity or availability of processed data in a negative way.
The security tests were carried out in accordance with generally accepted methodologies, including:
OWASP TOP10 (in a selected range), OWASP ASVS as well as internal good practices of
conducting security tests developed by Securitum.
As a part of the testing, an approach based on manual tests (using the above-mentioned
methodologies) was used, supported by a number of automatic tools, i.a. Burp Suite Professional,
DirBuster, ffuf, nmap, Visual Studio Code, semgrep, grep, sonarqube.
The vulnerabilities are described in detail in further parts of the report.
+48 (12) 361 3337 www.securitum.pl
securitum@securitum.pl www.sekurak.pl
2
Risk classification
Vulnerabilities are classified in a five-point scale reflecting both the probability of exploitation of the
vulnerability and the business risk of its exploitation. Below is a short description of meaning of each
of severity levels.
• CRITICAL - exploitation of the vulnerability makes it possible to compromise the server
or network device or makes it possible to access (in read and/or write mode) to data with
a high degree of confidentiality and significance. The exploitation is usually
straightforward, i.e. the attacker need not gain access to systems that are difficult to
achieve and need not perform any kind of social engineering. Vulnerabilities marked
CRITICAL must be fixed without delay, especially if they occur in production environment.
• HIGH - exploitation of the vulnerability makes it possible to access sensitive data (similar
to CRITICAL level), however the prerequisites for the attack (e.g. possession of a user
account in an internal system) makes it slightly less likely. Alternatively: the vulnerability
is easy to exploit but the effects are somehow limited.
• MEDIUM - exploitation of the vulnerability might depend on external factors (e.g.
convincing the user to click on a hyperlink) or other conditions that are difficult to achieve.
Furthermore, exploitation of the vulnerability usually allows access only to a limited set of
data or to data of a lesser degree of significance.
• LOW - the exploitation of the vulnerability results in little direct impact on the security of
the application or depends on conditions that are very difficult to achieve practically (e.g.
physical access to the server).
• INFO - issues marked as INFO are not security vulnerabilities per se. They aim to point
out good practices, whose implementation will result in increase of general security level
of the system. Alternatively: the issues point out some solutions in the system (e.g. from
an architectural perspective) that might limit the negative effects of other vulnerabilities.
Statistical overview
Below, a statistical overview of vulnerabilities is shown:
CRITICAL
HIGH
MEDIUM
LOW
INFO
0 1 2 3 4 5 6 7 8
+48 (12) 361 3337 www.securitum.pl
securitum@securitum.pl www.sekurak.pl
3
Contents
Security report .................................................................................................................................... 1
Executive summary ............................................................................................................................ 2
Risk classification .......................................................................................................................................... 3
Statistical overview ....................................................................................................................................... 3
Change history .................................................................................................................................... 5
Vulnerabilities in web applications - blackbox ................................................................................. 6
[MEDIUM] SECURITUM-212671-WEB-001: Reflected Cross-Site Scripting (XSS) .................................... 7
[LOW] SECURITUM-212589-WEB-003: Lack of protection against brute force attack on Yahoo account
..................................................................................................................................................................... 12
[LOW] SECURITUM-212589-WEB-004: Weak password policy .............................................................. 15
[LOW] SECURITUM-212589-WEB-005: Redundant information revealed about the application
environment in HTTP response headers .................................................................................................. 22
[INFO] SECURITUM-212671-WEB-002: Possibility to spoof the name of sender and recipient ........... 24
[INFO] SECURITUM-212589-WEB-006: Interaction with external service ............................................. 29
[INFO] SECURITUM-212589-WEB-007: Improper configuration of Content-Security Policy ................. 32
[INFO] SECURITUM-212589-WEB-008: X-XSS-Protection header enabled ............................................ 33
[INFO] SECURITUM-212589-WEB-009: HTML Injection .......................................................................... 35
[INFO] SECURITUM-212589-WEB-010: Potential XSS via drag&drop .................................................... 38
Source code – vulnerabilities ......................................................................................................... 41
[LOW] SECURITUM-212589-CODE-001: Outdated version of the NPM libraries .................................. 42
[INFO] SECURITUM-212589-CODE-003: Insecure implementation of some JavaScript functions ...... 45
+48 (12) 361 3337 www.securitum.pl
securitum@securitum.pl www.sekurak.pl
4
Change history
Document date Version Change description
14.05.2021 1.0 Final version of the report.
• Added vulnerabilities and recommendations:
o SECURITUM-212671-WEB-003
o SECURITUM-212671-WEB-004
o SECURITUM-212671-WEB-005
o SECURITUM-212671-WEB-006
o SECURITUM-212671-WEB-007
o SECURITUM-212671-WEB-008
o SECURITUM-212671-WEB-009
o SECURITUM-212671-WEB-010
• Removed the SECURITUM-212671-CODE-002
recommendation, as upon further inspection, it was
found that it is not necessary.
• Updated the Recommendation section of the
SECURITUM-212671-WEB-001 vulnerability, with a
more specific advice, which may allow to secure an
application against the Cross-Site Scripting
vulnerability, in this specific case.
06.05.2021 0.1 Draft of the rep