SQL Injection is a commonly used vector in which attackers insert malicious code into the input fields and gain unauthorized access to valuable records. This vulnerability was identified in the product where unsanitized user inputs could be manipulated to execute malicious SQL queries.

Cross-Site Request Forgery, or CSRF, is a type of attack in which unauthenticated users are forced to perform unwanted actions by using social engineering tricks, like sending a link through email or text. With this attack, the user acts on the attacker’s wish. If the victim is a normal user with basic access control, then the attackers can force the user to execute state-changing requests, like transferring funds. If the victim has administrative access, a successful CSRF attack can jeopardize the entire application.

Cross-site scripting attacks are a type of injection in which malicious scripts are injected into trusted websites. The attackers use a web application to send malicious code in the form of a browser-side script to an unsuspecting user. This way, the end user’s browser executes the malicious script, considering it is coming from a trusted source, and the malicious script can access the cookies, session tokens, and other sensitive information.

The regulatory reporting product had broken the access control system, which is established to control access or authority over information or functionality. The broken access control allows attackers to bypass authorization and give the highest level of access or authority, like the administrators. For instance, a user can change the account they are logged in simply by changing the URL without getting verified.

In the regulatory reporting product, the file uploading option plays a crucial role in submitting and managing data related to compliance, reporting, and analysis purposes. However, currently, the platform’s file upload functionality doesn’t enforce adequate validation or restrictions, permitting potentially malicious files to be uploaded. This can lead to server compromise or unauthorized code execution, affecting the workflow. This functionality also lacked an anti-virus check, meaning the platform didn’t scan the uploaded files for malicious content. It increases the risk of malware being introduced into the system.

In some of the application workflows, the rate-limiting mechanisms were missing. Rate limiting is a strategy that caps how often a user can perform a particular action. Since this mechanism was missing, it exposed the platform to brute force attacks, DoS and DDoS attacks, web scraping, or automated attacks, like credential stuffing or enumeration attacks.

The Forget Password functionality had two issues. First, it allowed user enumeration, and the platform displayed that the entered username was valid. Now, if attackers know that the username is correct, they can compromise the associated accounts through credential stuffing or guessing. Also, attackers can sell the list of collected valid usernames to a third party or use it for social engineering attacks.

The second issue was email flooding, as there was no limit on the number of OTP email requests that could be sent. This can flood the user’s email with unnecessary requests. Also, the attacker can use this as an opportunity to execute the DDoS attack by automating the OTP process.

Web cookies can become a key attack vector for malicious users, and applications should protect them. Cookies are used for different reasons, like session management, personalization, and tracking, and there are security attributes developed to lock down the cookies and limit their attacking surface. However, in the regulatory reporting platform, the cookies were improperly configured which increased the risk of session hijacking, data theft, or cross-site request forgery.

A significant issue with the platform that came up in the penetration testing was that the sessions remained active even after the user logged out. This is a security vulnerability as it allows the attacker to access the account data if the malicious actor has obtained the session token. This can lead to attacks like identity theft or fraud.

A server header mentions details about the server application that handles the request. It can reveal sensitive information, like software versions and technologies in use, which can expose the servers to attackers. Using this information, attackers can easily find vulnerabilities and exploit the system.

This HTTP Strict-Transport-Security response header informs the browser that the application can be accessed only using HTTPS. If it is accessed using HTTP, it should be automatically converted to HTTPS. However, the application doesn’t enforce HTTPS Strict Transport Security (HSTS), which makes it vulnerable to man-in-the-middle attacks by allowing connections over non-secure HTTP.

Upon thorough checking, it was identified that the application was using outdated versions of third-party libraries and dependencies, making it vulnerable to potential attacks. These libraries may have publicly exposed vulnerabilities that attackers can exploit to compromise the system. This increases the risk of attacks, such as remote code execution, unauthorized access, and data breaches.