Penetration Test Report (Cure53): pentest report casebox 2

Pentest-Report CaseBox Production 08.2014
Cure53, Dr.-Ing. Mario Heiderich / Dipl.-Ing. Johannes Dahse / Norman Hippert
Index
Intro
Scope
Identified Vulnerabilities
CB -02-001 Missing Security Checks allow Privilege Escalation ( High )
CB -02-003 User Information Disclosure ( Medium )
CB -02-004 WebDav Software causing crashes and Privilege Escalation ( High )
Miscellaneous Issues
CB -02-002 Apache SOLR Exception Information Disclosure ( Low )
CB -02-005 Possible Passive XSS in MSIE using poisoned PDF ( Medium )
CB -02-006 World Readable SSL Certificates can lead to MitM attacks ( Medium )
CB -02-007 Process Core Dumps can lead to potentia l Data Disclosure ( Low )
CB -02-008 UMASK settings are too lax and allow for world readable files ( Medium )
CB -02-009 Apache Server discloses Version Number ( Low )
CB -02-010 Unnecessary Apache Modules are enabled ( Low )
CB -02-011 Multiple Processes are running as roo t ( Medium )
CB -02-012 The TCP / IP configuration should be hardened ( Low )
CB -02-013 SSH Server uses a weak Server Key Length ( Medium )
CB -02-014 MySQL allows for loca l file access ( Medium )
CB -02-015 Missing File Integrity and Rootki t Checking ( Medium )
CB -02-016 Temporary Directory should be more restrictive ( Medium )
CB -02-017 No Linux Security Module was identified ( Medium )
CB -02-018 PHP open _ basedir to protec t multiple instances from another ( Medium )
Conclusion
1 / 15
Intro
“Casebox is being developed jointly by HURIDOCS and KETSE.com since 2011. It
started as a project to provide a sophisticated case management solution to one NGO,
and was subsequently expanded to become a flexible task, document and record
management system.”
From https :/ / www . casebox . org / abou t/
This penetration test was carried out by two testers of the Cure53 team over the period
of two days. Although the test yielded five new vulnerabilities and several weaknesses,
none of the findings were considered critical. Importantly, this test is a follow-up to an
earlier pentest and source-code audit conducted back in late June and early July this
year. The focus of this assignment was to test the security features of a CaseBox
instance running on a hardened server, which entails the majority of bugs reported
during and after the first test fixed. Any formerly discussed vulnerabilities originating from
the first testing phase and remaining unfixed were left out of scope within the framework
of this pentest. This applies to, for example, a Flash-XSS in one of the ExtJS modules,
which was reported as CB-01-0201 in the earlier communication and report.
A follow-up investigation covering the server configuration was performed after this
penetration test, involving one Cure53 senior tester for another two days. The purpose
was to check the server configuration for flaws and make sure the production instances
run on hardened systems. This investigation yielded another twelve weaknesses that
should be addressed to further secure the production machine.
Scope
● CaseBox Production Server
○ https :/ / swissdata . io / demo /
○ rmack: casebox
● SSH Access
1 https :/ / swissdata . io / demo / libx / ex t / resources / charts . sw f ? YUISwfId = aler t %281%29& YUIBridgeCallback = eval
2 / 15
Identified Vulnerabilities
The following sections list both vulnerabilities and implementation issues spotted during
the testing period. Note that findings are listed in a chronological order rather than by
their degree of severity and impact, which is simply given in brackets following the title
heading for each vulnerability. Each vulnerability is additionally given a unique identifier
for the purpose of facilitating future follow-up correspondence.
CB-02-001 Missing Security Checks allow Privilege Escalation (High)
A missing security check in CaseBox allows for a privilege escalation attack. Several
methods of the CB\Browser class are exposed by the router API. When modifying items,
they fail to verify the access privileges of the current user. This can lead to arbitrary item
modifications or item information disclosures. For example, the takeOwnership() method
sets both the owner ID (oid) and the user ID (uid) of any item in the tree to the current
user’s ID. Consequently, a malicious user may take ownership of the item with id 25413
by sending the following request:
POST /demo/remote/router.php HTTP/1.1
Host: swissdata.io
X-Requested-With: XMLHttpRequest
{"action":"CB_Browser","method":"takeOwnership","data":
[["25413"]],"type":"rpc","tid":14}
The targeted item’s id can be either obtained from the web interface or brute-forced.
Once the oid and uid of this item are changed to the current user’s ID, other methods
that actually do check for the access privileges can be (ab)used.
Furthermore, the following methods can be accessed from the router API and are
suspected to be vulnerable due to the missing security checks. They all allow specifying
a target object’s id or pid, even though the security permissions of a given object are not
validated with the current user’s ID.
Class Method Impact
CB_Browser saveFile write a file to another users’ secret folder
CB_Browser uploadNewVersion write a file to another users’ secret folder
CB_Browser toggleFavorite TBD
CB_Browser getObjectsForField leak meta-information on secret objects
CB_Browser subscribe none (feature currently not in use)
CB_BrowserView getChildren leak names of secret paths
3 / 15
CB_Objects getPluginsData leak meta-information on secret objects
CB_Objects addComment add comments to secret objects (Figure 1)
Fig. 1: Cecil Torres commented on Erik Norman’s private homefolder and uploaded a file
fake_report.html into his homefolder.
It is important to keep in mind that other methods might be equally vulnerable.
Therefore, all accessible methods should be checked for proper privilege validation
regarding the current session user’s ID. It is further recommended to address the
general topic of CSRF2 to facilitate mitigation of alike attacks triggered via social
engineering.
CB-02-003 User Information Disclosure (Medium)
Another privilege escalation issue spotted during the pentest allows attackers to
illegitimately gain admin access to the CaseBox application by disclosing information
and using it for brute-forcing / guessing passwords connected to the leaked usernames.
The reason for this can be traced to the privilege model that CaseBox employs for
certain classes and methods. More specifically, two methods of the CB\Security class
are not limited to administrators. They can be accessed directly by any user without the
privileges to obtain the lists of all user groups (searchUserGroups) and all active users
(getActiveUsers):
2 http :/ / en . wikipedia . org / wik i / Cross - site _ reques t _ forgery
4 / 15
{"action":"CB_Security","method":"getActiveUsers","data":[[]],
"type":"rpc","tid":14}
{"action":"CB_Security","method":"searchUserGroups","data":[[]],
"type":"rpc","tid":14}
To illustrate, the following list of user groups and active users (highlighted) could be
extracted from the swissdata.io server:
{"id":"235","name":"Administrators","system":"0","enabled":"1","iconCls":"icon-users"},
{"id":"236","name":"Managers","system":"0","enabled":"1","iconCls":"icon-users"},
{"id":"246","name":"Buenos Aires","system":"0","enabled":"1","iconCls":"icon-users"},
{"id":"234","name":"Everyone","system":"1","enabled":"1","iconCls":"icon-users"},
{"id":"249","name":"Lima","system":"0","enabled":"1","iconCls":"icon-users"},
{"id":"245","name":"London","system":"0","enabled":"1","iconCls":"icon-users"},
{"id":"242","name":"Moscow","system":"0","enabled":"1","iconCls":"icon-users"},
{"id":"243","name":"New York","system":"0","enabled":"1","iconCls":"icon-users"},
{"id":"244","name":"Paris","system":"0","enabled":"1","iconCls":"icon-users"},
{"id":"248","name":"San Francisco","system":"0","enabled":"1","iconCls":"icon-users"},
{"id":"233","name":"SYSTEM","system":"1","enabled":"1","iconCls":"icon-users"},
{"id":"247","name":"