Penetration Test Report (Securitum): enventory sample pentest report

Security report
SCOPE
Web application: eventory.cc
DATE
16.05.2019 – 17.06.2019
RETEST DATE
14.01.2020 – 21.01.2020
AUDITORS
Michał Bentkowski, Michał Sajdak
DOCUMENT VERSION
1.1
Confidential
Contents
CHANGE HISTORY ............................................................................................................................................................... 3
EXECUTIVE SUMMARY ........................................................................................................................................................ 4
SCOPE AND ASSUMPTIONS ................................................................................................................................................... 4
MOST SEVERE VULNERABILITIES IDENTIFIED ............................................................................................................................ 4
FIX STATUS ......................................................................................................................................................................... 4
STATISTICAL BREAKDOWN - DETECTED VULNERABILITIES: .......................................................................................................... 4
VULNERABILITIES’ RISK CLASSIFICATION ................................................................................................................................. 5
EVENTORY APPLICATION - VULNERABILITIES ................................................................................................................... 6
[HIGH] EVENTORY-001: STORED CROSS-SITE SCRIPTING IN ORGANIZATION ADDRESS FIELDS ( ADMIN ACCOUNT TAKEOVER) ....... 7
[HIGH] EVENTORY-002: CROSS-SITE SCRIPTING VIA POSTMESSAGE .................................................................................... 9
[HIGH] EVENTORY-003: HOST HEADER POISONING/HTML INJECTION IN PASSWORD RESET .................................................. 12
[HIGH] EVENTORY-004: ACCESS TO INTRA.EVENTORY.CC .................................................................................................. 13
[LOW] EVENTORY-005: BROKEN ACCESS CONTROL IN LIVEQA ............................................................................................ 14
[MEDIUM] EVENTORY-006: WEAK PASSWORD POLICY ..................................................................................................... 15
[MEDIUM] EVENTORY-007: MISSING BRUTE-FORCE PROTECTION ...................................................................................... 16
[MEDIUM] EVENTORY-008: RETURNING EXCESSIVE INFORMATION ABOUT EVENTS AND USERS / ENUMERATION OF USERS ........ 17
[MEDIUM] EVENTORY-009: XSS IN CDN.EVENTORY.CC ................................................................................................... 20
[MEDIUM] EVENTORY-010: INTRA.EVENTORY.CC – ATTACHMENTS AVAILABLE WITHOUT AUTHENTICATION ............................... 22
[LOW] EVENTORY-011: HTML INJECTION IN INVITATION EMAILS ........................................................................................ 23
[LOW] EVENTORY-012: XSS IN EMAIL CAMPAIGN PREVIEW / HTML INJECTION ................................................................... 24
+48 (12) 361 3337 www.securitum.pl
Bezpieczeństwo systemów IT securitum@securitum.pl www.sekurak.pl
2
Change history
Document date Version Change description
09.08.2019 1.0 The initial version.
28.01.2020 1.1 An updated executive summary with the status of issues after retest.
+48 (12) 361 3337 www.securitum.pl
Bezpieczeństwo systemów IT securitum@securitum.pl www.sekurak.pl
3
Executive summary
Scope and assumptions
This document is a summary of work conducted by Securitum. The subject of the test were the following web
applications of Eventory – event and conferences app.
The test was executed with the following assumptions in mind:
• The amount of work is fixed to maximum 7MD (Man Days),
• The main focus of the test is to obtain unauthorized access to user data,
• The test is blackbox,
• The test focuses on CRITICAL, HIGH and MEDIUM security issues.
Most severe vulnerabilities identified
• Various Cross-Site Scripting issues were exploited to steal administrator’s session and then to create
a new administrator user. Given that type of access, the testers were able to access data of all users
• Host header poisoning and HTML injection, giving the attacker the opportunity to steal password reset
tokens,
• Unauthorized access to an internal web application at intra.eventory.cc, giving the opportunity to read
certain internal discussions.
In total, 12 security issues have been identified. The vulnerabilities are described in detail in further parts of
the report.
Fix status
On 21.01.2020 it was confirmed that all the reported vulnerabilities are fixed.
Statistical breakdown - detected vulnerabilities:
CRITICAL
HIGH
MEDIUM
LOW
INFO
0 1 2 3 4 5 6
+48 (12) 361 3337 www.securitum.pl
Bezpieczeństwo systemów IT securitum@securitum.pl www.sekurak.pl
4
Vulnerabilities’ risk classification
Vulnerabilities are classified on a five-point scale reflecting both the probability of exploitation and the
business impact of the exploitation. A short description of each severity level is presented below.
• CRITICAL – exploitation of the vulnerability allows to compromise the server or network device, or
allows to access (in read and/or write mode) high-value data. The exploitation is usually
straightforward. Vulnerabilities marked CRITICAL must be fixed without delay, especially if they occur
in a production environment.
• HIGH – exploitation of the vulnerability makes it possible to access high-value data (similar to CRITICAL
level), however, the prerequisites for the attack (e.g. requirement for having a user account in an
internal system) makes it slightly less likely. Alternatively: vulnerability is easy to exploit but the
negative effects are somehow limited.
• MEDIUM – exploitation of the vulnerability might depend on external factors (e.g. convincing the user
to click on a hyperlink) or other conditions that are difficult to achieve. Furthermore, exploitation of
the vulnerability usually allows access only to a limited set of data or to data of a lesser degree of
significance.
• LOW – the exploitation of the vulnerability results in a little direct impact on the security of the
application or depends on conditions that are very difficult to achieve practically (e.g. physical access
to the server).
• INFO – issues marked as INFO are not security vulnerabilities per se. They aim to point out best
practices, whose implementation will increase the overall security level of the system. Alternatively:
the issues point out some solutions in the system (e.g. from an architectural perspective) that might
limit the negative effects of other vulnerabilities.
+48 (12) 361 3337 www.securitum.pl
Bezpieczeństwo systemów IT securitum@securitum.pl www.sekurak.pl
5
Eventory application - vulnerabilities
+48 (12) 361 3337 www.securitum.pl
Bezpieczeństwo systemów IT securitum@securitum.pl www.sekurak.pl
6
[HIGH] EVENTORY-001: Stored Cross-Site Scripting in organization
address fields ( admin account takeover)
SUMMARY
Users of the Eventory can add new organizations and define various information about them, including name,
description or contact data. All of the address fields are vulnerable to Cross-Site Scripting (XSS) making
possible to execute arbitrary JavaScript in context of the user visiting the page.
During the penetration test, this vulnerability was abused to steal HTTP cookies. Since the page was visited by
a user with administrator rights, effectively the vulnerability allowed to take over the administrator account.
The whole process is explained below in PoC (Proof of Concept).
Reference:
• https://en.wikipedia.org/wiki/Cross-site_scripting
PREREQUISITES FOR THE ATTACK
The victim needs to visit a maliciously prepared company page in Eventory.
TECHNICAL DETAILS (PROOF OF CONCEPT)
1. Go to https://eventory.cc/companies/myc