I busy with an exploitation process of TeamPass web application and I have identified multiple different countermeasures that could potentially be used or combined together for solving the horizontal privilege escalation vulnerability in TeamPass. TeamPass is a password management application and allows to obtain usernames and passwords of different users when exploited, thus allowing to escalate one's lower level privileges on the application.

The countermeasures that I have identified are:

  • Least Privileged
  • Privilege separation
  • Encryption
  • Multi-factor authentication and authorization.

In simple terms, which one of these countermeasures would be appropriate for solving the horizontal privilege escalation in TeamPass. and Briefly, why you suggested that one or combination, so I can understand the reason why that choice would be better.

Much appreciated

  • This is a spin of your old question. Yet, the vulnerability is fixed. Use the fixed code instead of trying to find workarounds with the broken code. – grochmal Oct 9 '16 at 18:28
  • @grochmal. I was not trying to make it a spin off from my other question, but I don't need to come up with a work around. All I am looking for is which of the countermeasures is what the fixed coding is doing. The reason why I'm asking is because here I have to explain it to other people, what countermeasure is used for fix and then the other question is actually solving the coding problem. So off the top of your head, which 1 of the countermeasures would best suit the fixed coding. Also if I get asked what countermeasure would the fixed coding related to I would like to know answer it. – John Oct 9 '16 at 18:38
  • The vulnerability was that one page showed passwords of any user (taken from ?id=<N>) to any logged in user. The fix was that they revamped the code to not show that. It was a blatant error that warranted a huge code revamp to fix (probably because things depended on that). But there are no countermeasures, it was a blatant coding error that queried the DB for the password of someone else. It simply is not there anymore. If you want to call it that you can say privilege separation, but that is a poor way of explaining it since it was not really added. – grochmal Oct 9 '16 at 18:53
  • As Grochmal says a fix is not a countermeasure. A countermeasure is a means by which you prevent a vulnerability from being exploited. The fix, in this context, removed the vulnerability. But I would still have a lot of concerns about keeping anything of value in teampass (and most other shareable secret managers) – symcbean Oct 9 '16 at 19:39
  • @symcbean. Thank you for your response and clarity. I am currently having a problem with viewing the clear text password. I have the followed this link and altered the coding in the, german and item.queries files back to the vulnerable code. However the clear text passwords are not showing. all its says on line 14 at the end (.....value="".....). Please could you advise what else I must do. Thanks in advanced. – John Nov 5 '16 at 17:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.