Penetration Test Report (SecureIdeas): SecureIdeas SampleReport 2020

FINAL DRAFT REPORT
Web Application Penetration Test
Prepared for Juice Shop
Engagement #: 20200501
Confidential and Proprietary Provided by Secure Ideas LLC sales@secureideas.com
All Rights Reserved [PII_REDACTED]
TABLE OF CONTENTS
TABLE OF CONTENTS 2
EXECUTIVE SUMMARY 3
NARRATIVE AND ACTIVITY LOG 4
FINDINGS AND RECOMMENDATIONS 8
RISK RATINGS 8
FINDINGS SUMMARY 9
HIGH RISK FINDINGS 9
1. SQL Injection Flaws 9
2. Authorization Bypass 11
3. Cross-Site Scripting Flaws 13
MEDIUM RISK FINDINGS 15
4. System Information Disclosure 15
6. Inadequate Security Standards for Password Storage 17
LOW RISK FINDINGS 19
5. Weak Password Complexity Requirements 19
STRATEGIC GUIDANCE 21
Provide Secure Coding Training for Developers 21
Encoding of Unsanitized Output 21
Confidential and Proprietary Provided by Secure Ideas LLC sales@secureideas.com
All Rights Reserved 2 [PII_REDACTED]
EXECUTIVE SUMMARY
Secure Ideas performed a penetration test of Juice Shop's web application. The scope of this
assessment, as provided by Juice Shop, was as follows:
● http://juice-shop.wtf
The following chart shows the count of findings by risk for this report:
High Medium Low
3 1 1
Based on the findings in this report, Secure Ideas has evaluated the overall risk to Juice Shop as it
pertains to the scope of this engagement is Very High:
Secure Ideas found multiple vulnerabilities in the Juice Shop web application. These weaknesses are
very concerning, and if leveraged, could decrease the security, usability, and functionality of the
application.
One of the most critical issues Secure Ideas found is that the application was not resistant to
injection-based attacks, which is considered one of the most dangerous attack vectors for applications.
One example showcasing the severity of this vulnerability was in our ability to craft a simple SQL injection
(SQLi) string to log in as the administrator of the application, without any prior knowledge of the username
or credentials. There were also several instances of Cross-Site Scripting (XSS) flaws throughout the
application. Both the SQLi and XSS flaws can easily be remediated through consistent input sanitization
and output encoding and are discussed further in the finding section below.
Another significant issue discovered is an authorization bypass flaw. Secure Ideas found that an attacker
can use the API to create a new user with any role, including administrator access. This is due to a lack
of authorization checking within the API. Consistency is important in authorization validation, and the
application must enforce it across all interfaces to prevent resources from being unprotected.
These, and the other issues found are outlined in the report that follows. Secure Ideas appreciates the
opportunity to work with Juice Shop to help improve its security posture.
Confidential and Proprietary Provided by Secure Ideas LLC sales@secureideas.com
All Rights Reserved 3 [PII_REDACTED]
NARRATIVE AND ACTIVITY LOG
Secure Ideas began by working through our standard methodology of Recon → Mapping → Discovery →
Exploitation. Since this assessment was not a black box assessment, the team skipped the initial Recon
phase, starting with Mapping and Discovery. Throughout the engagement, we conducted several types of
activities on each of the web interfaces within the Juice Shop application. The following list details the
high-level activities and considerations carried out during the engagement. This list is not inclusive of
every test performed.
● Conducted mapping of the in-scope application
● Evaluated for common web flaws such as:
○ Authentication and session management flaws
○ Authorization bypasses
○ JSON Web Token (JWT) manipulation
○ Cross-Origin Resource Sharing (CORS) misconfigurations
○ Cross-Site Request Forgery (CSRF)
○ Testing for Server-Side Request Forgery (SSRF)
○ Ineffective / misconfigured security controls
○ Injection flaws such as Cross-Site Scripting (XSS) and SQL Injection (SQLi)
○ Fuzzing of HTTP header values
○ HTTP verb tampering
○ Testing for HTTP Desync and Cache poisoning flaws
○ Fuzzing of query and body parameters
○ Client side JavaScript static and dynamic analysis
● Testing for other high-risk items including all testable vulnerabilities listed in the OWASP Top-10.
As part of the mapping phase, we explored all of the available functionality within the application using
each account role provided. Starting as a normal user, we began building a map of the application
features and potentially vulnerable areas, such as login forms, user profile pages, or input fields for
sensitive information. This process was also repeated under an administrative account, and the
differences in roles and access permissions were noted. By thoroughly mapping the application and
roles, we had developed a good idea of the functionality and features used within the application, as well
as how the application was intended to behave.
Next, we walked back through the application again, but this time from the perspective of a malicious user
or attacker. Instead of considering the expected actions from normal application usage, we applied
various techniques related to intercepting/manipulating outgoing requests or incoming responses, passing
malformed data to input fields, and attempting to generate unusual responses from the application.
When examining the login form, we noticed that single quotes could be used to cause errors on the page,
which is typically indicative of poor input handling. Additional probing showed that the Email field was
​ ​
susceptible to SQL injection. By entering the string ' or 1=1-- in the Email field, along with any value in
​ ​ ​ ​
the Password field, caused the application to evaluate the login condition as true. This authenticated us
​ ​ ​ ​
as the first entry in the Users database table, which is the administrator account. The results can be seen
in the screenshot shown below:
Confidential and Proprietary Provided by Secure Ideas LLC sales@secureideas.com
All Rights Reserved 4 [PII_REDACTED]
After observing that this field can be used to inject various types of SQL commands, we began
experimenting with different queries to see what other information could be gained in this manner. We
discovered that by applying a slight modification to the query, we were able to log into the next account in
the application. Using a query such as, ' or 1=1 and email not like('%admin%');-- , we were able to
​ ​ ​
filter out the admin account, moving the ‘login pointer’ to the next account in the database which didn’t
​ ​
contain the string admin. Using some creativity, and this query as a base template, an attacker could
​ ​
eventually enumerate the Users table to harvest every username it contained.
Due to the criticality of the SQLi, which allows an unauthenticated user to bypass the login authorization
process, Secure Ideas quickly reached out to the Juice Shop point of contact. A brief explanation of the
flaw was provided, sanitizing any specific information that shouldn’t be sent over unsecure email, and a
meeting was requested to review the findings discovered within the Juice Shop application.
While waiting for Juice Shop to respond, we continued our testing of the application. During this time,
another significant issue was discovered, which compounds the risk associated with the SQLi flaw noted
above. After logging into the account of the next user in the database, we took some time to inspect the
Change Password functionality. By default, the Change button used to update a user’s password is only
​ ​ ​
enabled when the Current Password, New Password, and Repeat New Password fields are populated
​ ​ ​ ​
correctly. However, we discovered that by using the browser’s f12 developer tools, a user’s password
can be updated without knowing the current password. This was accomplished by manipulating the
webpage submit action. As seen below, when changing the mat-raised-button mat-primary from disabled
​ ​ ​ ​ ​
to enabled, the pass