Penetration Test Report (Hackmanit): Penetration Test Report KeeWeb by Hackmanit

Open Penetration Test Report:
KeeWeb
Version: 1.0.2
22.04.2024
Dr. Marcus Niemietz
|
Phone: (+49)(0)234/45930961 E-Mail: marcus.niemietz@hackmanit.de
Project Information
Application: KeeWebv1.12.3(9b07bbd5,2019-11-06)
(https://keeweb.info)
Environment: web,native
Developer: DimitriWitkowski(Antelle)
Projectleader: HackmanitGmbH
Universitätsstraße60(Exzenterhaus)
44789Bochum,Germany
Projectexecutive: Dr. MarcusNiemietz
Phone: (+49)(0)234/45930961
Fax: (+49)(0)234/45930960
E-Mail: marcus.niemietz@hackmanit.de
Projectmembers: Dr. ChristianMainka(HackmanitGmbH)
KarstenMeyerzuSelhausen(HackmanitGmbH)
Prof. Dr. JurajSomorovsky(HackmanitGmbH)
Projectperiod: 2020-03-16–2020-04-03
Versionofthereport: 1.0.2
ThisreportwastechnicallyverifiedbyDr. ChristianMainka.
ThisreportwaslinguisticallyverifiedbyDavidHerring.
HackmanitGmbH
Representedby: Prof. Dr. JörgSchwenk,Prof. Dr. JurajSomorovsky,
Dr. ChristianMainka,Prof. Dr. MarcusNiemietz
Registercourt: AmtsgerichtBochum,HRB14896,Germany
1
Contents
Contents
1 Summary 3
2 ProjectTimeline 4
3 Methodology 4
4 GeneralConditionsandScope 5
5 OverviewofWeaknesses,Recommendations,andInformation 6
6 Weaknesses 8
6.1 H01 UseoftheDeprecatedOAuthImplicitGrant . . . . . . . . . . . . . . . . . . 8
6.2 H02 XSSviaFormFields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
6.3 H03 XSSviaaPseudo-ProtocolDefinition . . . . . . . . . . . . . . . . . . . . . . 12
6.4 M01 UseofanEmbeddedUser-AgentforUserAuthentication . . . . . . . . . 13
6.5 M02 PossibleAccessTokenInjectionwithpostMessage()API . . . . . . . . . . 15
6.6 M03 ViolationoftheOAuth2.0BestCurrentPractices . . . . . . . . . . . . . . 16
7 Recommendations 18
7.1 R01 DeliveringtheContentSecurityPolicy . . . . . . . . . . . . . . . . . . . . . 18
7.2 R02 ImplementingaLogoutOption . . . . . . . . . . . . . . . . . . . . . . . . . . 18
8 References 19
2
1 Summary
1 Summary
HackmanitGmbHhastestedthesecurityofthewebapplicationandnativeapplicationKeeWeb
within10workingdays. KeeWebwastestedinversion1.12.3. Themainfocusofthissecurity
auditwastodetectJavaScriptbasedcodeinjectionandrisksintheauthorizationprocesswith
third-partycloudstorageproviders.
Weaknesses. Duringthepenetrationtest, threeweaknessesclassifiedas Highandthreefur-
therweaknessesclassifiedasMediumwereidentified. Thehighestrankedweaknesstargeted
theOAuthgrantusedwhenauserwantstograntKeeWebaccesstotheircloudstorage. The
used OAuth implicit grant exposes the access token to a substantial attack surface including
thebrowserhistory. Astolenaccesstokenallowsanattackertoaccessarbitraryfilesstoredin
the user’s cloud storage. The other two weaknesses classified as High allow the execution of
malicious JavaScriptcode in the user’sbrowser. This allowsan attackerto access the opened
password database of the victim and steal their credentials. The other weaknesses generally
increasetheattacksurfacefortheaccesstokenandtheuser’scredentialstotheutilizedcloud
storageprovider. Additionally,oneweaknessmightallowanattackertoinjecttheirownaccess
tokenintheuser’sbrowserandmakethevictimusetheattacker’scloudstorageforadditional
actions.
Werecommendedfixingallidentifiedweaknessestopreventattacks,aswellasimplementing
theadditionalrecommendationstofurtherincreasethesecurityofKeeWebtoMr. Witkowski,
whoisthemaincontributorofKeeWeb.
Mr. WitkowskifollowedourrecommendationsandreleasedKeeWebversionv1.14.2on2020-
05-04. We can confirm that v1.14.2 successfully fixes all identified weaknesses and imple-
mentsouradditionalrecommendations.
Top Weaknesses:
RiskLevel Finding Reference
H01 UseoftheDeprecatedOAuthImplicitGrant Section6.1,page8
H02 XSSviaFormFields Section6.2,page10
H03 XSSviaaPseudo-ProtocolDefinition Section6.3,page12
Structure. Thereportisstructuredasfollows:InSection2,thetimelineofthepenetrationtest
is listed. Section 3 introduces our methodology and Section 4 explains the general conditions
andscopeofthepenetrationtest. Section5providesanoverviewoftheidentifiedweaknesses,
as well as, further recommendations and information. In Section 6, all identified weaknesses
arediscussedindetailandspecificcountermeasuresaredescribed.Section7summarizesour
recommendations resulting from observations of the application. Finally, ?? lists additional
teststhatdidnotrevealanyweaknesses.
3
3 Methodology
2 Project Timeline
The penetration test was performed remotely from Bochum within the time frame starting at
2020-03-16 until 2020-04-03. In total, Hackmanit invested 10 working days to test the ap-
plicationandwritethisreport.
The weaknesses identified during the penetration test were responsibly disclosed to Mr.
Witkowski as the main contributor of the KeeWeb project on 2020-04-16. Mr. Witkowski
started to fix the weaknesses immediately and released a first update (v1.14) for KeeWeb on
2020-04-18.
HackmanitconductedashortretestoftheidentifiedweaknessesandinformedMr. Witkowski
that all weaknesses except M03 (Missing mix-up attack protection) were successfully fixed
on2020-04-30. Mr. Witkowskireleasedasecondupdate(v1.14.2)on2020-05-04fixingthe
lastweakness. Mr. WitkowskialsoimplementedbothrecommendationslistedinSection7.
3 Methodology
Amongothers,thefollowingtoolswereusedforthepenetrationtest:
Tool Link
MozillaFirefox https://www.mozilla.org/de/firefox/
GoogleChrome https://www.google.com/intl/de_ALL/chrome/
InternetExplorer -
Safari -
BurpSuiteProfessional https://portswigger.net/burp
Self-developedtools -
Risk Rating. Each weakness has its own CVSS 3.1 base score rating (Common Vulnerability
Scoring System Version 3.1 Calculator).1,2 Based on the CVSS 3.1 base score, the following
weaknessesassessmentisperformed:
0.0–3.9: Low
4.0–6.9: Medium
7.0–8.9: High
9.0–10.0: Critical
1https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
2https://www.first.org/cvss/v3.1/user-guide
4
4 GeneralConditionsandScope
4 General Conditions and Scope
Hackmanit announced in September 2019 that Hackmanit offers a pro bono penetration test
programforwebandsinglesign-on(SSO)applications.3 Inahalf-yearcycle,startinginJanuary
2020, Hackmanit started to offer a free remote penetration test to support non-commercial
organizations.
HackmanitispleasedthatMr. Witkowski,whoisthemaincontributoroftheprojectKeeWeb,4
sent a request to test the application. KeeWeb is a free cross-platform password manager
compatiblewithKeePass. Furthermore,itisanimplementationofapasswordmanagerrunning
insideabrowser. Itdoesnotrequireanyserverandaimstoworkwithsensitivedata, suchas
user passwords. Hackmanit has investigated parts of the implementation with a main focus
on JavaScriptbased code injection and risks within the authorization processwith third-party
cloudstorageproviders.
Informationaboutthetestedapplication:
• KeeWebv1.12.3(9b07bbd5,2019-11-06)
• Environment: web,native
3https://www.hackmanit.de/de/blog/80-pro-bono-penetration-test
4https://keeweb.info
5
5 OverviewofWeaknesses,Recommendations,andInformation
5 Overview of Weaknesses, Recommendations, and Information
RiskLevel Finding Reference
H01 Use of the Deprecated OAuth Implicit Grant: The Section6.1,page8
application uses the implicit grant to gain access to-
kens from different authorization servers. According
to the OAuth 2.0 best current practices, the implicit
grantshouldnotbeusedanymore.
H02 XSS via Form Fields: HTML form fields can be used Section6.2,page10
toinjectJavaScriptcodeintotheapplication.
H03 XSSviaaPseudo-ProtocolDefinition: Thepseudo- Section6.3,page12
protocoljavascript:allowsanattackertospec-
ify JavaScript code, which will be executed after a
clickevent.
M01 Use of an Embedded User-Agent for User Authen- Section6.4,page13
tication: The native application uses an embedded
user agent (UA) to prompt the user for authentica-
tion when accessing a cloud storage. According to
the RFC “OAuth 2.0 for Native Apps”, native appli-
cationsmustnotuseembeddedUAsbutinsteadthe
system’sdefaultbrowser.
M02 Possible Access Token Injection with postMes- Section6.5,page15
sage()API:Whentheapplicationreceivesmessages
sentusingthep