2

We have a web application that stores cached information in browser (both is firefox and chrome).

When we subjected it to Penetration Testing, a finding was filed saying that "Senstive Data such as Database Name, Storage and Version were found stored in the local IndexedDB".

Although clicking each DB do not reveal any information inside it.

enter image description here

enter image description here

My question is - is this really an issue? as far as I know, the Database Name, Storage and Version are like autogenerated information and not really sensitive information from the application.

Can anyone help us and shed some light on this?

3
  • 2
    Pentesting reports are often extremely dumb and just list any finding without any regard as ro whether that finding would have any security impact. This can be a real problem if you're required to fix all findings foe compliance reasons.
    – amon
    Commented Apr 12, 2021 at 6:48
  • 2
    @amon poorly written pentesting reports produced entirely through automated tools just list any finding without any regard as to whether that finding would have any security impact. You do know that much of this community are professional testers who provide real value and you just insulted all of them through cynical over-generalization, don't you?
    – schroeder
    Commented Apr 14, 2021 at 11:57
  • @schroeder I'm sorry, you're right that I phrased that in a disrespectful manner. However, not every pentester provides “real value”. My intention was to encourage OP to push back against “findings” that have no demonstrable security impact, especially since this particular pentester seems to have no technical understanding of IndexedDB.
    – amon
    Commented Apr 16, 2021 at 11:23

2 Answers 2

3

Have a look at this blog post and corresponding presentation by Pomcor. It goes through various browser side storage options including IndexedDB and what vulnerabilities apply.

The short answer is IndexedDB is vulnerable to malware and physical takeover attacks. It's better than many options because cryptography is done outside the browser execution environment, but it's not totally secure.

I suspect this is what the pen test result is getting at.

3

When we subjected it to Penetration Testing, a finding was filed saying that "Senstive Data such as Database Name, Storage and Version were found stored in the local IndexedDB".

The people who performed your pen test should be providing you with some evidence, screenshot, full/redacted values they obtained. It is possible they just ran an automated tool that say some form of local storage and they just complained about that in general. I would go back and ask them to clarify exactly what they found and why its a problem.

As client-side storage, I would assume the data present will depend on the client and what they were doing in the app. The DB may be empty when you visit, but maybe the account they used for their attack had access to other data.

If you have third party JavaScript which is allowed to read from IndexedDB and you store an API key or something like that there then the third party script could obtain it, in contrast to using a cookie with the httponly attribute.

1
  • IndexedDB cannot be accessed by any third party libraries because browsers maintain cross-origin policies. Only possible if developer is serving third party library from same origin/domain or has provided way through its own APIs to connect to IndexeDB Commented Mar 26 at 7:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .