Penetration Test Report (AssuredAB): Assured Mullvad API audit report 2022

Report
Mullvad API pentest
Emilie Barse, Benjamin Svensson
Project Version Date
MUL007 v1.3 2022-12-20
REPORT
Project Version Date
MUL007 v1.3 2022-12-20
Executive summary
Between 2022-11-07 and 2022-11-29 Assured Security Consultants performed an API
penetration test on behalf of Mullvad VPN.
The in-scope items are the API published on api.mullvad.net, its related services
and configuration. A testing environment was installed on [REDACTED HOSTNAME] to
perform the test against. The test was performed with access to the API source
code and with shell access to the installed test environment.
No critical, high or medium rated issues were identified during the penetration
test and the overall security of the API is deemed good. We identified one issue
related to how secrets are managed in the docker environment, which could expose
unnecessary secrets if an attacker identifies a way to read environment
variables. All other issues are related to the API implementation. There are a
few issues where an attacker could send the API input which is passed directly
to a function without being filtered for any unexpected characters. Even though
we weren’t successful in exploiting these issues, it’s good practice to verify
user input before passing it to functions.
This report is listing the security issues found, along with recommendations for
fixing or mitigating them. In our conclusions we discuss the issues and address
apparent patterns in areas where security is lacking.
Issues were found with the following risk severity assessments (number of
issues):
Critical 0 High 0 Medium 0 Low 7 Note 5
We recommend to
• Implement Hashicorp Vault to manage secrets in Docker
• Remove unnecessary read-write permissions on bind-mounts in docker
• Implement encryption in transit for the Redis serivce
• Verify user input and only accept expected data. If any special characters
is required these should be handled with extra care
• Remove account numbers from GET request URLs
• Handle the unexpected error in /app/v1/replace−wireguard−key
• Use the same type of throttling with IP-blocking for both authentication
endpoints. Or use the same authentication endpoint for both use cases
i
REPORT
Project Version Date
MUL007 v1.3 2022-12-20
• Enforce increased complexity and length of the admin passwords, implement
blacklist.
Assured would like to thank Simon, Alexander, Grégoire, Michal and Richard for
their support during this penetration test. We are happy to answer any questions
and provide further advice.
ii
REPORT
Project Version Date
MUL007 v1.3 2022-12-20
Contents
1 Introduction 1
1.1 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.2 Constraints and disclaimer . . . . . . . . . . . . . . . . . . . . . 1
1.3 Project period and staffing . . . . . . . . . . . . . . . . . . . . 1
1.4 Risk rating . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
2 Scope and methodology 3
2.1 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.2 Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.2.1 Tools used . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.3 Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
3 Observations - Docker 6
3.1 Low Unencrypted network traffic to Redis . . . . . . . . . . . . . 6
3.2 Note Unnecessary read-write permissions on bind-mounts . . . . . . 7
3.3 Note Secrets in docker-compose.yml and environment variables . . . 8
4 Observations - API 10
4.1 Low HTML injection in email . . . . . . . . . . . . . . . . . . . . 10
4.2 Low Unverified user input . . . . . . . . . . . . . . . . . . . . . 10
4.3 Low IP blocking can be circumvented . . . . . . . . . . . . . . . . 11
4.4 Low Sensitive information in URL . . . . . . . . . . . . . . . . . 12
4.5 Low Admin password change does not enforce policy . . . . . . . . . 12
4.6 Low Potential Slowloris attack (DoS) . . . . . . . . . . . . . . . 13
4.7 Note Unexpected behaviour of refund with amount zero . . . . . . . 14
4.8 Note Recent actions shows wrong amount on refunds . . . . . . . . . 15
4.9 Note Unhandled error . . . . . . . . . . . . . . . . . . . . . . . 16
5 Conclusions and recommendations 17
iii
REPORT
Project Version Date
MUL007 v1.3 2022-12-20
1 Introduction
1.1 Background
Assured AB (Assured) was contracted by Mullvad VPN to perform a security
assessment on their API and related source code.
1.2 Constraints and disclaimer
This report contains a summary of the findings found during the project period.
This report should not be considered as a complete list of all vulnerabilities,
security flaws and/or misconfigurations.
1.3 Project period and staffing
Assured started the project on 2022-11-07 and finished on 2022-11-29.
This report was last reviewed on 2022-12-20.
Involved in the penetration testing were Assured consultants Emilie Barse and
Benjamin Svensson.
1.4 Risk rating
In this report we have assessed the severity of issues and identified
vulnerabilities. The levels of severity are rated according to the OWASP Risk
Rating Methodology [1].
Table 1: OWASP Risk Rating overall severity model
Overall risk severity
HIGH Medium High Critical
MEDIUM Low Medium High
Impact
LOW Note Low Medium
LOW MEDIUM HIGH
Likelihood
As Table 1 visualizes, the overall risk assessment is determined from a combined
likelihood and impact of an identified vulnerability or security issue. A value
from 0 to 9 is assessed for each variable, where 0-2 is determined LOW, 3-5 is
MEDIUM and 6-9 is HIGH.
Likelihood is dependant on attributes related to threat actors and the
identified vulnerability, with factors such as: the skill level and motivations
1
REPORT
Project Version Date
MUL007 v1.3 2022-12-20
of the threat agents; how easily the vulnerability can be found and exploited,
and; how likely an exploit may be detected.
Impact depends on technical and business factors, such as: level of loss of
confidentiality, integrity, availability and accountability; potential financial
damage; potential brand damage, and; potential violations of privacy.
Please note that the severity assessment is made by Assured consultants and
ratings may differ from the resource owners’ ratings.
2
REPORT
Project Version Date
MUL007 v1.3 2022-12-20
2 Scope and methodology
2.1 Scope
The API (api.mullvad.net) and all its related functions are in-scope for this
assessment. A test environment was installed and configured to be used as a
target for the assessment. Part of the test was also the message-queue,
dns-janitor functions and the docker configuration.
The test was done as a white-box test with access to code, credentials for the
different business roles, and ssh access into the test system host. The
environment was setup with access to third party test environment and related
API keys, for services such as Stripe and Paypal.
2.2 Methodology
The test was performed using primarily dynamic testing and source code review.
The source code was mainly used as a support in the dynamic testing and a full
code review has not been performed.
Network traffic and logs were examined during the test to understand the
application flow and to check the management of events in the backend as well as
to identify any personal identifiable information (PII).
MullvadAPI The API was tested using static source code analysis for Python
called bandit to find common security issues in Python code. The source code was
also used to aid in the dynamic testing to setup and execute functional API
requests and understanding the business flow of the API.
All endpoints in the API was tested dynamically using Burp Suite Pro.
We followed the OWASP API Security project top 10 list [2] to ensure good
coverage during the test, the list includes the following items:
• API1 Broken Object Level Authorization
• API2 Broken User Authentication
• API3 Excessive Data Exposure
• API4 Lack of Resources & Rate Limiting
• API5 Broken Function Level Authorization
• API6 Mass Assignment
3
REPORT
Project Version Date
MUL007 v