Bug: Privilege Escalation Attack Vulnerability.

[entrotech]

Overview

The City's Information Technology Agency (ITA) reported that a security vulnerability has been reported for the production web site https://tdm.ladot.lacity.org. Out application is vulnerable to a Privilege Escalation attack. A PDF of the email report is below in the Resources section. John Darragh has been able to reproduce the attack using Burpsuite to intercept the login response as described in the email, and confirmed that the attack allows the attacker to register as a user with no special privileges and then escalate their privileges to those of an Admin or Security admin by simple manipulation of the HTTP response to the registered user's account.

Action Items

• Confirm the reported vulnerability. Confirmed by John Darragh. Also confirmed that the interception allows the attacker to actually act as an admin or security admin and perform escalated actions.
• Disable the production website until the issue can be resolved.
• Develop application modifications to prevent the attack.
• Demonstrate that attack is thwarted.
• Deploy fix and test in the development environment.
• Release new version of the application.
• Re-Enable the production web site.

Resources/Instructions

TDM Privilege Attack Vulnerability.pdf

[entrotech]

Read about Privilege Escalation attacks as linked in the description above.

To perform HTTP Request and/or Response Interception, you can use the Community Edition of Burpsuite. Work through the tutorials on how to intercept and modify the response as described in the referenced email. See if you can also reproduce the attack.

Do some research on how to prevent such attacks and we will get together on Wednesday to discuss options.

[entrotech]

Here is a video demonstrating the attack before fixed:
https://drive.google.com/file/d/1Qb4C0jkX3_c_US-UbCTov0Dw2XoZhd1p/view?usp=sharing

And here is a video demonstrating the thwarted attack after the fix:
https://drive.google.com/file/d/1_1XEgWuUrmPkJywhvj4zSJWQyOSBk-z4/view?usp=sharing