3

I'm testing a website to find out vulnerabilities. Website is fully running on HTTPS only.

While testing, I came to know that the pdf files can be downloaded by authorized users only. This functionality is accessible after being logged-in into the application.

Suppose this is the path:

https://www.test-site.com/confarea/private/ebook.pdf

But when I'm changing the https request into http like below, I'm able to download the file directly without any restrictions.

http://www.test-site.com/confarea/private/ebook.pdf

So, according to OWASP Top 10 - 2013:

  • What kind of vulnerability is this? Does it belong to "A4 – Insecure Direct Object References" or "A7 – Missing Function Level Access Control"?
  • Does this vulnerability has any particular name?
  • What would be the severity and impact?

Please explain it in-depth.

  • I don't think that's a vulnerability or a security issue. Did you setup your web server correctly??? – pbalazek May 11 '15 at 12:22
  • How is this not a vulnerability? If one can access confidential files by directly accessing the url/page without any privileges, it's a major issue/vulnerability. I'm not a developer. I'm just testing a website for vulnerability assessment. – magneto May 11 '15 at 12:32
  • If I understand correctly, the webserver wasn't setup correctly. It's restricting the access successfully on https but not in http probably because of bad config. You can call it vulnerability, surely (my mistake). To answer your question - which I forgot (apologize me). It's A4. – pbalazek May 11 '15 at 12:39
  • 1
    The description clearly shows a vulnerability and security issue. Such issues do not limit themselves to getting a root shell on the exploited server, depending on the concerned data allowing unauthorized access to sensitive data may have major business consequences. And yes, this vulnerability is most probably caused by a server / web application misconfiguration to be reported. – WhiteWinterWolf May 11 '15 at 12:39
1

The web server seems to apply different security control whether the access comes from HTTPS and from HTTP.

Most probable is that the designers thought that this file would be accessible only to HTTPS users, and missed the fact that this URL can also be served through HTTP.

In your question you refer to:

  • A7 – Missing Function Level Access Control: This flaw is about a mismatch between the options proposed in the web interface and the options actually accepted on the web server side, the error being to disable an option only on the interface without disabling its use on the server side. Here there no mention of web interface, and allowed user should use HTTPS link anyway, so this is not the correct topic to classify the current issue.
  • A4 – Insecure Direct Object References: This flaw seems to address merely internal objects access, ie. objects which should not be accessed at all. However, one may argue that this file should indeed not be accessed at all through HTTP, so from this point of view it might be a correct topic.

Otherwise, "A5 - Security Misconfiguration" may also match since this is just a setting issue, either an HTTPS file access setting wrongly affecting HTTP accesses, or a missing restriction on HTTP file accesses.

Regarding the technical impact, it gives unauthorized people access to this file. The business impact directly depends on the file's content.

  • thanks for explanation. But what name should I give to this vulnerability? How should I explain this to web-developer? Any description about this kind of vulnerability and any mitigation steps? or should I write it on my own? – magneto May 11 '15 at 12:41
  • Either you have access to the server configuration or website code, then you are on your own to dig and provide more advanced information to the developers, or you do not have such access then a description similar to your question showing the expected behavior, how it can be circumvented and the potential business impacts will do it (up to the developers or the web admin to provide a fix). Choosing between A4 and A5 will mainly depend on the context, but A4 may bear a more precise and suitable name. – WhiteWinterWolf May 11 '15 at 12:50
1

You haven't mentioned whether you have tried the request with cookies (or other authentication data) withheld.

If the request still works without authentication for the same scheme and you've removed caching headers like If-Modified-Since and If-None-Match then it is "A4 – Insecure Direct Object References". If the request works only when you haven't altered the request to disable cached responses then this is "A5-Security Misconfiguration" because the application is caching private content.

If the request works with cookies on both HTTP and HTTPS, then this is also "A5-Security Misconfiguration". This is because the application should be setting the Secure Flag on cookies or ideally implementing HSTS to prevent authentication cookies from being sent over an insecure connection.

  • I have accessed that HTTP request without any authentication. When I intercepted that request, this is the response header I received: HTTP/1.1 200 OK Date: Tue, 12 May 2015 17:29:20 GMT Server: Apache Last-Modified: Fri, 05 Dec 2014 04:13:15 GMT Etag: "de4349-11aa5-509704bb9acc0" Accept-Ranges: bytes Content-Length: 72357 Cache-Control: max-age=31536000 Expires: Wed, 11 May 2016 17:29:20 GMT Connection: keep-alive, close Content-Type: image/jpeg – magneto May 12 '15 at 17:30
  • @magneto: Therefore this is "A4 – Insecure Direct Object References" - is this for a different file as I noticed the content type says jpeg.? – SilverlightFox May 12 '15 at 17:36
  • ok. And yeah, this request is for image file. You won't believe but this website has all the confidential contents available after converting it from HTTPS to HTTP! I'm wondering what name should I give to this vulnerability? I put severity as High and it has severe business impact also. Any additional suggestion from you regarding this vuln.? – magneto May 12 '15 at 17:46
  • @magneto: Probably both A4 and A5 as it appears to be a config issue also. – SilverlightFox May 12 '15 at 18:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.