Penetration Testing for an Enterprise Resource Planning Platform

Summary

A US-based provider of an ERP platform for the produce industry — which includes a payment system and must stay compliant with NYDFS and PCI DSS — added a new web service to its platform and needed a competent penetration testing vendor to check the new components for vulnerabilities. INNERLUXES performed black- and gray-box pentesting, revealed 13 security issues, and delivered severity-ranked remediation guidance in 10 days.

About the Customer

The Customer is a US-based provider of an enterprise resource planning (ERP) platform for the produce industry. It helps automate and optimize production management, invoicing and accounting, sales, inventory management, logistics, and more.

The Challenge

As a US provider of an ERP platform that contains a payment system, the Customer strives to stay compliant with NYDFS and PCI DSS cybersecurity requirements. After introducing a new web service to its platform, the Customer was looking for a competent penetration testing vendor to check the newly added components for vulnerabilities that could compromise the platform's security.

The Solution

The Customer entrusted the penetration testing project to INNERLUXES's ethical hackers. To investigate how a real-world malicious actor could detect and exploit potential vulnerabilities in the ERP platform, the team started with black-box pentesting. Acting as outside attackers, they targeted the new web application, an API (with 100 endpoints), and 5 public IPs. At the next stage, they were provided with low-privilege user credentials to proceed with gray-box penetration testing.

As a result, the team revealed 13 security issues, including:

• Absent bearer-token expiration timer, enabling a potential attacker to bypass authentication without entering a login and password.
• User enumeration vulnerability that could be used to discover valid usernames for subsequent brute-force attacks.
• Unlimited failed login attempts, enabling brute-forcing of popular username and password combinations until a working one is found.
• Absent single logout (SLO) — pressing the logout button in one application module didn't log the user out of the others.
• Missing secure cookie attributes — a malicious actor could attempt a man-in-the-middle attack to access cookie content and hijack a session, stealing authentication details or other sensitive information.
• Missing CSRF tokens that protect against cross-site request forgery, and more.

INNERLUXES classified the detected vulnerabilities by severity to help prioritize remediation and described the necessary corrective measures, including:

• Revoking the bearer token after a user logs out and limiting the token's validity period (e.g., to an hour).
• Using generic error messages in response to an invalid username or password during login.
• Setting a limited number of failed login attempts, after which the account is blocked for several minutes with an email notification to the owner; implementing CAPTCHA.
• Configuring single logout (SLO) across all ERP modules and implementing automatic session timeout.
• Adding security attributes to cookies and limiting cookie lifetime.
• Adding CSRF tokens to all forms that allow users to perform state-changing operations.

The entire pentesting project, from planning to reporting, took 10 days.

The Results

• Thanks to the thorough pentesting, the Customer quickly identified the vulnerabilities that could expose its ERP platform to security breaches.
• The final report served as actionable guidance for efficient vulnerability remediation and a valuable addition to the Customer's compliance documentation.

Technologies and Tools

Metasploit, Nessus, Burp Suite, Acunetix, Nmap, DirB, SQLMap, Postman.