Vulnerability Assessment & Penetration testing for a SaaS Rewards Platform customer

A startup SaaS provider specializes in providing end-to-end reward experience to employees, colleagues and customers. Given the sensitivity of the data they handle, ensuring the security of their web application is paramount. To identify vulnerabilities and enhance their security posture, the provider engaged Ryval-X (an AWS Advanced Partner) to conduct a comprehensive penetration test of their web application.

THE CHALLENGE

Identify Vulnerabilities: Uncover potential security weaknesses in the web application.
Assess Impact: Evaluate the potential impact of discovered vulnerabilities on the business.
Enhance Security: Provide recommendations to mitigate identified risks.
Compliance: Ensure the web application meets industry standards and regulatory requirements.

Scope:

The penetration test focused on the provider’s SaaS platform, which included features such as user authentication, fund transfers, account management, and transaction history.
Both authenticated and unauthenticated access points were tested.
The testing was conducted in a non-production environment to avoid disrupting live services.

Ryval-X Methodology:

Ryval-X penetration test process followed a structured approach based on the OWASP Testing Guide: Information Gathering:

The penetration test focused on the provider’s SaaS platform, which included features such as user authentication, fund transfers, account management, and transaction history.
Both authenticated and unauthenticated access points were tested.
The testing was conducted in a non-production environment to avoid disrupting live services.

Identity Management Testing:

User authentication mechanisms were tested for vulnerabilities, such as weak passwords, lack of multi-factor authentication (MFA), and password reset flaws.
Authorization checks were performed to ensure proper role-based access control.

Authentication Testing:

Brute force attacks were attempted to identify weak login credentials.
Session management issues, such as session fixation and session hijacking, were tested.

Input Validation Testing:

The application was tested for common input validation issues, including SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF).
Automated tools and manual techniques were used to identify injection points and other input-related vulnerabilities.

Client-Side Testing:

The client-side code (JavaScript) was reviewed for vulnerabilities.
The security of cookies, local storage, and other client-side storage mechanisms was assessed.

Configuration and Deployment Management Testing:

The configuration of the web server, application server, and database was reviewed for misconfigurations.
SSL/TLS configurations were examined to ensure secure communication.

Our Findings:

Critical:

SQL Injection: Identified in the login form, allowing attackers to bypass authentication and access sensitive data.
Insecure Direct Object References (IDOR): Allowed unauthorized users to access other users’ account information.

High:

Cross-Site Scripting (XSS): Found in the transaction history page, enabling attackers to execute malicious scripts in users’ browsers.
Weak Password Policy: Allowed users to set easily guessable passwords, increasing the risk of account compromise.

Medium:

Session Management Flaws: Sessions were not properly invalidated upon logout, potentially allowing session hijacking.
Missing HTTP Security Headers: Lack of security headers like Content Security Policy (CSP) and X-Content-Type-Options.

Low:

Information Disclosure: Error messages revealed sensitive information about the application stack.

Ryval-X Recommendations:

Remediation:

Implement parameterized queries to prevent SQL injection.
Use secure coding practices to validate and sanitize all user inputs.
Enforce strong password policies and implement MFA.
Properly manage user sessions and invalidate them upon logout.
Add necessary security headers to HTTP responses.

Enhancements:

Conduct regular security audits and penetration tests.
Provide security training for developers.
Establish a vulnerability management program to address and track security issues.

Monitoring and Response:

Implement intrusion detection and prevention systems.
Set up real-time monitoring and alerting for suspicious activities.

The Ryval-X Impact:

The SaaS provider promptly addressed the critical and high-severity vulnerabilities, significantly reducing their risk exposure.
The provider implemented the recommended security measures and improved their overall security posture.
Regular security assessments were established to maintain a robust security framework.

What Customer Realized:

By conducting a thorough penetration test, the SaaS provider not only identified and mitigated existing vulnerabilities but also strengthened their security practices, ensuring the safety and trust of their customers.

Schedule a discussion

Let our architect help you find your next cloud solution

Talk to our Cloud Architect

Ryval-X achieves AWS Service Delivery Designation for AWS APIGateway Read More

Ryval-X achieves AWS Service Delivery Designation for AWS DynamoDB Read More