Penetration Test Report (RadicallyOpenSecurity): 2017 Pentest Ushahidi crowdsource mapping tool v1.0

Confidential
PENETRATION TEST REPORT
for
Open Technology Fund
V1.0
Amsterdam
March 3rd, 2017
1/65 Radically Open Security B.V. - 60628081
Confidential
Document Properties
Client Open Technology Fund
Title PENETRATION TEST REPORT
Targets Ushahidi Platform V3 API
Ushahidi Platform Client
Ansible Playbooks
Hybrid Mobile UI for Ushahidi Platform
Version 1.0
Pentesters Stefan Vink, Giovanni Cruz Forero
Authors Stefan Vink, Peter Mosmans
Reviewed by Peter Mosmans
Approved by Peter Mosmans
Version control
Version Date Author Description
0.1 February 23rd, 2017 Stefan Vink Initial draft
0.2 February 27th, 2017 Stefan Vink V1
0.3 February 28th, 2017 Stefan Vink Review
1.0 March 3rd, 2017 Peter Mosmans Final edits
Contact
For more information about this Document and its contents please contact Radically Open Security B.V.
Name Melanie Rieback
Address Overdiemerweg 28
1111 PP Diemen
The Netherlands
Phone +31 6 10 21 32 40
Email info@radicallyopensecurity.com
2/65 Radically Open Security B.V. - 60628081
Confidential
Table of Contents
1 Executive Summary ....................................................................................................................................... 5
1.1 Introduction .................................................................................................................................................. 5
1.2 Scope of work ............................................................................................................................................. 5
1.3 Project objectives ........................................................................................................................................ 5
1.4 Timeline ....................................................................................................................................................... 5
1.5 Results In A Nutshell .................................................................................................................................. 5
1.6 Summary of Findings .................................................................................................................................. 6
1.7 Summary of Recommendations .................................................................................................................. 8
2 Methodology ................................................................................................................................................. 10
2.1 Planning .................................................................................................................................................... 10
2.2 Risk Classification ..................................................................................................................................... 10
3 Reconnaissance and Fingerprinting ............................................................................................................ 12
3.1 Automated Scans ...................................................................................................................................... 12
4 Pentest Technical Summary ........................................................................................................................ 13
4.1 Findings ..................................................................................................................................................... 13
4.1.1 USH-001 — OAuth 2.0 Token Sent to Third Party ................................................................................ 13
4.1.2 USH-002 — Sql Injection (X.ushahidi.io) ............................................................................................... 14
4.1.3 USH-003 — Weak Diffie-Hellman Key Exchange (X.ushahidi.io) .......................................................... 17
4.1.4 USH-004 — Creation And Post Date Can Be Manipulated By Client ................................................... 19
4.1.5 USH-005 — Open Port 22 SSH (Ushahidi.com) ................................................................................... 21
4.1.6 USH-006 — Path Disclosure Revealed by Stacktrace (Ushahidi.io) ..................................................... 22
4.1.7 USH-007 — API Does Not Have a CSRF Protection (X.ushahidi.io) .................................................... 23
4.1.8 USH-008 — Persistent Cross Site Scripting in Post Description (X.ushahidi.io) ................................... 25
4.1.9 USH-009 — Persistent Cross Site Scripting Site Description (X.ushahidi.io) ........................................ 26
4.1.10 USH-010 — Password Resetlink Does Not Use a Https Connection. (X.ushahidi.io) ......................... 28
4.1.11 USH-011 — Length of Password is Not Validated After Reset (X.ushahidi.io) .................................... 29
4.1.12 USH-012 — Lack of Bruteforce Protection new user. (X.ushahidi.io) .................................................. 31
4.1.13 USH-013 — CORS Policy allows access from any domain. (X.ushahidi.io) ........................................ 32
4.1.14 USH-014 — No Clickjacking Protection .............................................................................................. 35
4.1.15 USH-015 — Missing X-XSS-Protection HTTP Header ........................................................................ 36
4.1.16 USH-016 — SSL Cookie Without Secure Flag Set (Ushahidi.io) ........................................................ 37
4.1.17 USH-017 — The Session Does Not Expire When the User Logs Out. (X.ushahidi.io) ........................ 39
4.1.18 USH-018 — Ansible - No Firewall Restrictions SSH ........................................................................... 40
4.1.19 USH-019 — Ansible - User Januus ..................................................................................................... 42
4.1.20 USH-020 — Ansible - Weak Password Mysql ..................................................................................... 43
4.1.21 USH-021 — Oauth2 Implementation (X.ushahidi.io) ........................................................................... 43
4.1.22 USH-022 — Role Creation and Permission Assignment ..................................................................... 45
4.1.23 USH-023 — Internal Server Error While Uploading Photo (X.ushahidi.io) .......................................... 46
4.1.24 USH-024 — Retrieve Available Member-roles as an Anonymous User. (X.ushahidi.io) ...................... 48
4.1.25 USH-025 — Vagrant - Public Image .................................................................................................... 49
4.1.26 USH-026 — Retrieve Members With Low Privilege User. (X.ushahidi.io) ........................................... 50
4.1.27 USH-027 — Ansible - Passwords in Different Files ............................................................................ 51
4.1.28 USH-028 — Multiple Oauth2 Requests using Grant_type Client_credentials. (X.ushahidi.io) ............. 52
4.1.29 USH-029 — API-key Secure Storage .................................................................................................. 54
4.1.30 USH-030 — SSH Server of ushahidi.com Insufficiently Hardened ...................................................... 55
3/65 Radically Open Security B.V. - 60628081
Confidential
4.2 Non-Findings ............................................................................................................................................. 57
4.2.1 Laravel Session Implementation (Ushahidi.io) ....................................................................................... 57
4.2.2 Access to Resources Without Auth Token (X.ushahidi.io) ..................................................................... 58
4.2.3 User Is Not Allowed to Change Password From Other User. (X.ushahidi.io) ........................................ 58
4.2.4 XML External Entity (X.ushahidi.io) ........................................................