From 82a76d0616889790bd5d42c1096e99fcbb73a780 Mon Sep 17 00:00:00 2001 From: Ryan Rudder <96507400+RRudder@users.noreply.github.com> Date: Tue, 15 Aug 2023 17:15:42 +1000 Subject: [PATCH 1/2] Addition of insufficient verification of data authenticity MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ...subcategory and variants As per the VRT update in 352 - bugcrowd/vulnerability-rating-taxonomy#352 --- .../cryptographic_signature/guidance.md | 5 +++++ .../recommendations.md | 7 ++++++ .../cryptographic_signature/template.md | 22 +++++++++++++++++++ .../guidance.md | 5 +++++ .../identity_check_value/guidance.md | 5 +++++ .../identity_check_value/recommendations.md | 7 ++++++ .../identity_check_value/template.md | 22 +++++++++++++++++++ .../recommendations.md | 7 ++++++ .../template.md | 22 +++++++++++++++++++ 9 files changed, 102 insertions(+) create mode 100644 submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/cryptographic_signature/guidance.md create mode 100644 submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/cryptographic_signature/recommendations.md create mode 100644 submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/cryptographic_signature/template.md create mode 100644 submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/guidance.md create mode 100644 submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/identity_check_value/guidance.md create mode 100644 submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/identity_check_value/recommendations.md create mode 100644 submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/identity_check_value/template.md create mode 100644 submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/recommendations.md create mode 100644 submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/template.md diff --git a/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/cryptographic_signature/guidance.md b/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/cryptographic_signature/guidance.md new file mode 100644 index 00000000..de7d44c6 --- /dev/null +++ b/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/cryptographic_signature/guidance.md @@ -0,0 +1,5 @@ +# Guidance + +Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. This will speed triage time and result in faster rewards. Please include specific details on where you identified the insufficient verification of the cryptographic signature, how you identified it, and what actions you were able to perform as a result. + +Attempt to escalate the vulnerability to perform additional actions. If this is possible, provide a full Proof of Concept (PoC). diff --git a/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/cryptographic_signature/recommendations.md b/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/cryptographic_signature/recommendations.md new file mode 100644 index 00000000..b32f05f4 --- /dev/null +++ b/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/cryptographic_signature/recommendations.md @@ -0,0 +1,7 @@ +# Recommendation(s) + +Implement strong cryptography and keep up to date algorithms, protocols, and keys in place. Ensure that the application validates the cryptographic signature and associated data, and denies requests that contain an invalid cryptographic signature. + +For more information, refer to the following resource: + +- diff --git a/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/cryptographic_signature/template.md b/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/cryptographic_signature/template.md new file mode 100644 index 00000000..9cb2c885 --- /dev/null +++ b/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/cryptographic_signature/template.md @@ -0,0 +1,22 @@ +# Cryptographic Signature + +## Overview of the Vulnerability + +Cryptography is used to ensure secure storage and transmission of data. However, there are a number of best practices that must be followed to ensure the cryptography in use remains secure and does not result in the exposure of sensitive data. It was identified that the application fails to very the cryptographic signature. Ths can allow an attacker to break the confidentiality and integrity of requests sent to and from the endpoint. + +## Business Impact + +This vulnerability can lead to reputational damage of the company through the impact to customers’ trust, and the ability of an attacker to view data. The severity of the impact to the business is dependent on the sensitivity of the accessible data being transmitted by the application. + +## Steps to Reproduce + +1. Enable a HTTP interception proxy, such as Burp Suite or OWASP ZAP +1. Setup {{software}} to intercept and log requests +1. Use a browser to navigate to: {{URL}} +1. {{action}} to view unencrypted requests + +## Proof of Concept (PoC) + +The screenshot below demonstrates the insufficient validation of the cryptographic signature: + +{{screenshot}} diff --git a/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/guidance.md b/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/guidance.md new file mode 100644 index 00000000..c4430038 --- /dev/null +++ b/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/guidance.md @@ -0,0 +1,5 @@ +# Guidance + +Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. This will speed triage time and result in faster rewards. Please include specific details on where you identified the insufficient verification of data authenticity, how you identified it, and what actions you were able to perform as a result. + +Attempt to escalate the vulnerability to perform additional actions. If this is possible, provide a full Proof of Concept (PoC). diff --git a/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/identity_check_value/guidance.md b/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/identity_check_value/guidance.md new file mode 100644 index 00000000..13b6ece1 --- /dev/null +++ b/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/identity_check_value/guidance.md @@ -0,0 +1,5 @@ +# Guidance + +Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. This will speed triage time and result in faster rewards. Please include specific details on where you identified the insufficient verification of ICV authenticity, how you identified it, and what actions you were able to perform as a result. + +Attempt to escalate the vulnerability to perform additional actions. If this is possible, provide a full Proof of Concept (PoC). diff --git a/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/identity_check_value/recommendations.md b/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/identity_check_value/recommendations.md new file mode 100644 index 00000000..a38ee13a --- /dev/null +++ b/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/identity_check_value/recommendations.md @@ -0,0 +1,7 @@ +# Recommendation(s) + +Implement strong cryptography and keep up to date algorithms, protocols, and keys in place. Ensure that the application validates the authenticity of the ICV data and follows best practices for ICV validation steps. + +For more information, refer to the following resource: + +- diff --git a/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/identity_check_value/template.md b/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/identity_check_value/template.md new file mode 100644 index 00000000..4b823ad5 --- /dev/null +++ b/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/identity_check_value/template.md @@ -0,0 +1,22 @@ +# Integrity Check Value (ICV) + +## Overview of the Vulnerability + +Cryptography is used to ensure secure storage and transmission of data. However, there are a number of best practices that must be followed to ensure the cryptography in use remains secure and does not result in the exposure of sensitive data. It was identified that the authenticity of the Integrity Check Value (ICV) is not verified which can lead to data corruption. Ths can allow an attacker to break the confidentiality and integrity of requests sent to and from the endpoint. + +## Business Impact + +This vulnerability can lead to reputational damage of the company through the impact to customers’ trust, and the ability of an attacker to view data. The severity of the impact to the business is dependent on the sensitivity of the accessible data being transmitted by the application. + +## Steps to Reproduce + +1. Enable a HTTP interception proxy, such as Burp Suite or OWASP ZAP +1. Setup {{software}} to intercept and log requests +1. Use a browser to navigate to: {{URL}} +1. {{action}} to view unencrypted requests + +## Proof of Concept (PoC) + +The screenshot below demonstrates the insufficient verification of the ICV: + +{{screenshot}} diff --git a/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/recommendations.md b/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/recommendations.md new file mode 100644 index 00000000..312fc4b8 --- /dev/null +++ b/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/recommendations.md @@ -0,0 +1,7 @@ +# Recommendation(s) + +Implement strong cryptography and keep up to date algorithms, protocols, and keys in place. Ensure that the application validates the authenticity of the data used across the cryptographic implementations. + +For more information, refer to the following resource: + +- diff --git a/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/template.md b/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/template.md new file mode 100644 index 00000000..f2064f49 --- /dev/null +++ b/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/template.md @@ -0,0 +1,22 @@ +# Insufficient Verification of Data Authenticity + +## Overview of the Vulnerability + +Cryptography is used to ensure secure storage and transmission of data. However, there are a number of best practices that must be followed to ensure the cryptography in use remains secure and does not result in the exposure of sensitive data. It was identified that the authenticity of the data used in the cryptographic processes is not verified which can lead to data corruption. Ths can allow an attacker to break the confidentiality and integrity of requests sent to and from the endpoint. + +## Business Impact + +This vulnerability can lead to reputational damage of the company through the impact to customers’ trust, and the ability of an attacker to view data. The severity of the impact to the business is dependent on the sensitivity of the accessible data being transmitted by the application. + +## Steps to Reproduce + +1. Enable a HTTP interception proxy, such as Burp Suite or OWASP ZAP +1. Setup {{software}} to intercept and log requests +1. Use a browser to navigate to: {{URL}} +1. {{action}} to view unencrypted requests + +## Proof of Concept (PoC) + +The screenshot below demonstrates the insufficient verification of data authenticity: + +{{screenshot}} From 9086a154adc7fa78d6712d48ad95b423763079c6 Mon Sep 17 00:00:00 2001 From: RRudder <96507400+RRudder@users.noreply.github.com> Date: Wed, 25 Oct 2023 15:22:18 +1000 Subject: [PATCH 2/2] Typo fix --- .../cryptographic_signature/template.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/cryptographic_signature/template.md b/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/cryptographic_signature/template.md index 9cb2c885..b61636a6 100644 --- a/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/cryptographic_signature/template.md +++ b/submissions/description/cryptographic_weakness/insufficient_verification_of_data_authenticity/cryptographic_signature/template.md @@ -2,7 +2,7 @@ ## Overview of the Vulnerability -Cryptography is used to ensure secure storage and transmission of data. However, there are a number of best practices that must be followed to ensure the cryptography in use remains secure and does not result in the exposure of sensitive data. It was identified that the application fails to very the cryptographic signature. Ths can allow an attacker to break the confidentiality and integrity of requests sent to and from the endpoint. +Cryptography is used to ensure secure storage and transmission of data. However, there are a number of best practices that must be followed to ensure the cryptography in use remains secure and does not result in the exposure of sensitive data. It was identified that the application fails to verify the cryptographic signature. Ths can allow an attacker to break the confidentiality and integrity of requests sent to and from the endpoint. ## Business Impact