Penetration Test Report (Bugcrowd): Instructure Canvas Security Summary 2021

Penetration Test
Results
Engineering, Security, and
Operations
February 2021
In this guide,
you’ll learn:
How we partner with the third-party
provider BugCrowd for ongoing
penetration testing of our applications and
services.
Table of Contents
Executive Summary ................................................................................................................................. 3
Reporting and Methodology ................................................................................................................... 4
Targets and Scope ................................................................................................................................... 5
Findings Summary ................................................................................................................................... 6
Appendix .................................................................................................................................................. 14
Closing Statement .................................................................................................................................. 16
Executive Summary
This is Instructure’s 10th annual open security audit and once again Instructure engaged Bugcrowd, Inc. to perform an Ongoing Bounty
Program, commonly known as a crowd-sourced penetration test for its products.
An Ongoing Bounty Program is a cutting-edge approach to an application assessment or penetration test. Traditional penetration tests
use only one or two personnel to test an entire scope of work, while an Ongoing Bounty leverages a crowd of security researchers. This
increases the probability of discovering esoteric issues that automated testing cannot find and that traditional vulnerability assessments
may miss in the same testing period.
The purpose of this engagement was to identify security vulnerabilities in the targets listed in the targets and scope section. Once
identified, each vulnerability was rated for technical impact defined in the findings summary section of the report.
This report shows testing for Canvas LMS, Bridge, Studio, Practice, and Portfolium’s targets during the period of: 01/01/2020 –
12/31/2020.
For this Ongoing Program, submissions were received from 60 unique researchers.
The continuation of this document summarizes the finding, analysis, and recommendations from the Ongoing Bounty Program performed
by Bugcrowd for the 2021 Penetration Test Report.
If you are interested in joining our bug bounty program as a security researcher, please contact security@instructure.com with your
Bugcrowd username and we will get you hooked up!
Keep learning,
Josh Blackwelder,
Sr. Director and Head of Security
security@instructure.com
February 2021
Reporting and Methodology
The strength of crowdsourced testing lies in multiple researchers, the pay-for-results model, and the varied methodologies that the
researchers implement. To this end, researchers are encouraged to use their own individual methodologies on Bugcrowd ongoing
programs.
Bugcrowd researchers who perform web application testing and vulnerability assessment usually subscribe to a variety of methodologies
following the highlighted workflow, including the following:
February 2021
Targets and Scope
Prior to the Ongoing program launching, Bugcrowd worked with Instructure to define the Rules of Engagement, commonly known as the
program brief, which includes the scope of work. The following targets were considered explicitly in scope for testing:
iOS Applications
iOS App: Canvas Student
iOS App: Polls for Canvas
iOS App: Canvas Teacher
iOS App: Canvas Parent
Android Applications
Android App: Canvas Student
Android App: Polls for Canvas
Android App: Canvas Teacher
Android App: Canvas Parent
Canvas LMS
https://bugcrowd-tc.instructure.com
https://commons-pdx-edge.inseng.net
https://catalog-bugcrowd.inscloudgate.net
Canvas Studio
https://sectest.beta.instructuremedia.com
Portfolium
https://*.qa.ops.portfolium.net
Bridge Suite
https://*.suite.staging.bridgeapp.com
https://bugcrowd*.staging.bridgeapp.com
https://bugcrowd*.perform.stage.bridgeapp.com
https://*.stage.practice.xyz
February 2021
Findings Summary
FINDINGS BY SEVERITY
The following chart shows all valid assessment findings from the program by technical severity.
February 2021
RISK AND PRIORITY KEY
The following key is used to explain how Bugcrowd rates valid vulnerability submissions and their technical severity. As a trusted advisor
Bugcrowd also provides common “next steps” for program owners per severity category.
Technical Severity Example Vulnerability Types
Critical • Remote Code Execution
Critical severity submissions (also known as “P1” or “Priority 1”) are • Vertical Authentication Bypass
submissions that are escalated to Instructure as soon as they are
• XML External Entities Injection
validated. These issues warrant the highest security consideration and
• SQL Injection
should be addressed immediately. Commonly, submissions marked as
Critical can cause financial theft, unavailability of services, large-scale
account compromise, etc.
High • Lateral Authentication Bypass
High severity submissions (also known as “P2” or “Priority 2”) are • Stored Cross-Site Scripting
vulnerability submissions that should be slated for fix in the very near
• Cross-Site Request Forgery for a critical function
future. These issues still warrant prudent consideration but are often not
• Internal Server-Side Request Forgery
availability or “breach level” submissions. “Commonly, submissions
marked as High can cause account compromise (with user interaction),
sensitive information leakage, etc.
Medium • Reflected Cross-Site Scripting with limited impact
Medium severity submissions (also known as “P3” or “Priority 3”) are • Cross-Site Request Forgery for an important function
vulnerability submissions that should be slated for fix in the major release
• Insecure Direct Object Reference for a function
cycle. These vulnerabilities can commonly impact single users but require
user interaction to trigger or only disclose moderately sensitive
information.
Low • Cross-Site Scripting with limited impact
Low severity submissions (also known as “P4” or “Priority 4”) are • Cross-Site Request Forgery for an unimportant function
vulnerability submissions that should be considered for fix within the next
• External Server-Side Request Forgery
six months. These vulnerabilities represent the least danger to
confidentiality, integrity, and availability.
Informational • Lack of code obfuscation
Informational submissions (also known as “P5” or “Priority 5”) are • Autocomplete enabled
vulnerability submissions that are valid but out-of-scope or are “won’t fix”
• Non-exploitable SSL issues
issues, such as best practices
February 2021
Bugcrowd’s Vulnerability Rating Taxonomy
More detailed information regarding Bugcrowd’s vulnerability classification can be found at: https://bugcrowd.com/vrt
FINDINGS TABLE
The following tables list all valid assessment findings from the program.
MOBILE APPLICATIONS
Title VRT Duplicates Priority State
Stored XSS in iOS App via URL Fragment Cross-Site Scripting P2 Resolved
(XSS)
Open redirect (Android only) Unvalidated P4 Resolved
Redirects and
Forwards
CANVAS LMS
Title VRT Duplicates Priority State
Stored XSS via Student via bypass of htmlEscape JS function Cross-Site Scripting P2 Resolved
(XSS)
Unauthenticated Canvas DoS via GraphQL Application-Level P2 Resolved
Denial-of-Service
(DoS)
Stored XSS via Group Cross-Site Scription P3 Resolved
(XSS)
Reflected Cross Site Scripting on Quizzes can be used to steal access Cross-Site Scripting P3 Resolved
tokens (XSS)
February 2021
Title VRT Duplicates Priority State
Stored XSS via files domain + Additional chainable vulnerabilities Cross-Site Scripting P3 Resolved
(XSS)
Stored XSS via course link validator Cross-Site Scripting P3 Resolved
(XSS)
Bypassing 2FA using Backup Codes Broken P3 Resolved
Authentication and
Session
Management
Con