Gray Box Penetration Testing for an Enterprise Finance SaaS

Summary

A US-based SaaS company offering workforce and financial management solutions needed to ensure the maximum security of its clients' financial data. It engaged INNERLUXES to examine the web application for its spend-management SaaS platform. Following industry-standard methodologies, INNERLUXES performed gray-box penetration testing, uncovered multiple security flaws, and delivered a prioritized remediation report in ten days.

About the Customer

The Customer is a US-based SaaS company offering workforce management and financial management solutions.

The Challenge

To ensure the maximum security of its clients' financial data, the Customer was looking for a cybersecurity vendor with experience in the finance sector. The Customer turned to INNERLUXES to examine the web application for its spend-management SaaS platform.

The Solution

INNERLUXES's experts conducted security testing of the Customer's web app following the PTES, OWASP Web Security Testing Guide, and NIST 800-115 methodologies. The process started with a vulnerability assessment: the testers scanned the target application and manually validated the detected security weaknesses to eliminate false positives.

To evaluate the potential impact of the found security gaps, the team performed gray-box pentesting. After receiving low-privilege user credentials from the Customer, INNERLUXES's team explored the vulnerabilities by acting as an intruder who had gained access to the target web application.

During the pentesting, INNERLUXES revealed authentication and authorization flaws, a lack of resources and rate limiting, security misconfigurations, CSV injection flaws, and other security issues. The pentesters suggested protective measures to secure the Customer's app, including:

• Enforcing a proper access-control mechanism so that regular users cannot access information and features intended for privileged users — otherwise broken access control could result in sensitive-data disclosure, data manipulation, or data loss.
• Enforcing request rate limiting and strict limits on pagination parameters. Without these, an attacker could overload the server by sending too many requests or requesting more data than intended, causing excessive resource consumption, database-performance issues, and denial of service (DoS).
• Implementing subresource integrity (SRI) checks for scripts loaded from third-party domains, reducing the risk of malware infection, user-data leakage, and execution of malicious JavaScript.
• Implementing input validation to prohibit entering special characters in website forms available for import/export as a CSV file, plus field data sanitization when content is exported as a CSV file — protecting users from CSV files with malicious commands embedded in spreadsheet formulas that could be used to hijack user PCs.

The Results

• In only ten days, the Customer received a comprehensive report summarizing the testing activities, the assessment results, and a prioritized list of corrective actions for each found vulnerability.
• The detailed remediation advice helped the Customer quickly fortify the security of its spend-management application and ensure full protection of its clients' sensitive data.

Technologies and Tools

Burp Suite, SSLScan, Nmap, SQLMap, JWT_Tool, Nikto, Zed Attack Proxy (ZAP), PHP, Bash, Python, PowerShell.