A data exposure vulnerability in an onboarding app
- Testing time
- 1 day
- Sensitive documents protected
- 400+
A short pentest of a staff onboarding portal found that any user could download other people’s identity documents.
The Problem
A Namibian company was running an onboarding application and staff portal for employees. Part of the process involved uploading files through the system, which used AWS S3 presigned URLs to handle the uploads. While presigned URLs ruled out many traditional file upload vulnerabilities, access control remained critically important. To assess this, a short pentest was run against the platform.
The Finding
During the test, Aphotic found that the onboarding portal also handled applications to the company, which required applicants to upload sensitive documents. These included identity card scans, social security details and driver’s licences.
Further investigation of the upload process revealed that it used S3 presigned URLs, built from parameters passed from the client side.
A key aspect of presigned URLs in AWS is that they handle authentication, but not authorisation. Typically, an application that uses presigned URLs signs them with a single IAM identity that has full access to the underlying S3 bucket. As a result, the application must enforce its own authorisation checks before it issues a presigned URL to access or upload content.
The application in question did not perform sufficient cross-user authorisation checks to ensure that the content requested through a presigned URL actually belonged to the user requesting it. As a result, it was possible to make the application generate a presigned URL for another user’s documents, allowing sensitive information to be exfiltrated from other users of the application.
The Fix
Aphotic recommended that the upload functionality be modified to associate the object key of each uploaded file with the identity of the user who uploaded it, and that authorisation controls be implemented on the server side. While the files themselves would not be stored on the server, it would keep a record of file ownership, so that authorisation checks could be carried out.
Once the team had implemented these changes, Aphotic retested and confirmed that the vulnerability had been remediated, protecting the sensitive data uploaded and preventing a potentially catastrophic data exposure.