Merge pull request #568 from bugcrowd/v1.18.1-update-various

Informational (P5) Update

Author: RRudder

submissions/description/broken_authentication_and_session_management/excessive_jwt_lifetime/guidance.md

@@ -0,0 +1,7 @@
+# Guidance
+
+Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. This will speed triage time and result in faster rewards.
+
+Include a screenshot showing the decoded JWT payload with the `iat` and `exp` claims visible. Calculate and state the token lifetime in hours or days. Do not submit tokens belonging to other users. A screenshot from a JWT decoder tool such as `jwt.io` is acceptable as evidence.
+
+Attempt to escalate the broken authentication or session management to perform additional actions (such as an account takeover or CSRF bypass to perform a sensitive action). If this is possible, provide a full Proof of Concept (PoC).

submissions/description/broken_authentication_and_session_management/excessive_jwt_lifetime/recommendations.md

@@ -0,0 +1,15 @@
+# Recommendation(s)
+
+Broken authentication issues can be remediated by implementing a handful of best practices relating to authentication and session management to ensure secure implementation. These include:
+
+- Reducing the JWT lifetime to the minimum duration required for the application's use case
+- Pairing all short-lived access tokens with a refresh token mechanism that allows the client to obtain new access tokens without requiring reauthentication
+- Storing refresh tokens securely, rotating them on each use, and making them revocable by the server
+- Ensuring that server-side token revocation for logout and password change events is implemented.
+
+The verification logic of the application, as well as all of the above, should be thoroughly tested during the development and QA phases of an application build.
+
+For further information, refer to Open Web Application Security Project (OWASP) guides located at:
+
+- <https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html>
+- <https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/>

submissions/description/broken_authentication_and_session_management/excessive_jwt_lifetime/template.md

@@ -0,0 +1,20 @@
+JSON Web Tokens (JWTs) are used by the application for session management or API authentication. The application issues JWTs with an excessively long expiration time, meaning a token remains valid for an extended period after it is issued. The long lifetime gives an attacker a larger window to use the stolen token before it expires. This increases the impact of any token compromise by extending the period during which the attacker can impersonate the legitimate user.
+
+**Business Impact**
+
+This vulnerability can lead to reputational damage and indirect financial loss to the company as customers may view the application as insecure.
+
+**Steps to Reproduce**
+
+1. Enable a HTTP interception proxy, such as Burp Suite or OWASP ZAP
+1. Use a browser to navigate and perform a login at: {{URL}}
+1. Capture the JWT issued in the {{token_location}}
+1. Decode the JWT payload at {{jwt_decode_tool}} and examine the `exp` claim
+1. Calculate the token lifetime by comparing the `iat` and `exp` values
+1. Confirm that the token lifetime is {{token_lifetime}}, which exceeds a reasonable session duration
+
+**Proof of Concept (PoC)**
+
+The screenshot(s) below demonstrate(s) the vulnerability:
+>
+> {{screenshot}}

submissions/description/broken_authentication_and_session_management/secret_questions_account_verification/guidance.md

@@ -0,0 +1,5 @@
+# Guidance
+
+Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. This will speed triage time and result in faster rewards.
+
+Include a screenshot showing the secret question presented during the account recovery or verification flow. Show that the question is used as a verification factor rather than as supplementary information. Do not attempt to access other users' accounts. Your own account is sufficient to demonstrate the weakness.

submissions/description/broken_authentication_and_session_management/secret_questions_account_verification/recommendations.md

@@ -0,0 +1,3 @@
+# Recommendation(s)
+
+Remove secret questions and replace them with stronger verification methods such as email-based or SMS-based verification codes, time-limited password reset tokens, or multi-factor authentication. If a secondary verification step is required, use a one-time code sent to a pre-registered contact method rather than static knowledge-based questions.

submissions/description/broken_authentication_and_session_management/secret_questions_account_verification/template.md

@@ -0,0 +1,17 @@
+The application uses secret questions (also known as security questions or knowledge-based authentication) as a method for verifying a user's identity during account recovery or sensitive operations. Secret questions weaken the overall security of the application as the answers are often guessable, publicly available through social media, or shared across multiple services. An attacker who can determine or guess the answer to a user's secret question can bypass the intended verification step and gain access to the account recovery flow.
+
+**Business Impact**
+
+This vulnerability can lead to reputational damage and indirect financial loss to the company as customers may view the application as insecure.
+
+**Steps to Reproduce**
+
+1. Use a browser to navigate to: {{URL}}
+1. Enter a username and proceed to the account verification step
+1. Observe that the application presents a secret question: {{secret_question}}
+
+**Proof of Concept (PoC)**
+
+The screenshot(s) below demonstrate(s) the vulnerability:
+>
+> {{screenshot}}

submissions/description/insufficient_security_configurability/no_two_fa_implementation/guidance.md

@@ -0,0 +1,7 @@
+# Guidance
+
+Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. This will speed triage time and result in faster rewards.
+
+Include a screenshot of the account security settings page showing the absence of any 2FA or multi-factor authentication option.
+
+Attempt to escalate the broken authentication or session management to perform additional actions (such as an account takeover or CSRF bypass to perform a sensitive action). If this is possible, provide a full Proof of Concept (PoC).

submissions/description/insufficient_security_configurability/no_two_fa_implementation/recommendations.md

@@ -0,0 +1,3 @@
+# Recommendation(s)
+
+Implement 2FA support, preferably using time-based one-time passwords (TOTP) or hardware security keys (WebAuthn/FIDO2) as as a stronger option. Provide backup recovery codes during enrollment. Enforce 2FA for accounts with administrative privileges and encourage adoption across all user accounts.

submissions/description/insufficient_security_configurability/no_two_fa_implementation/template.md

@@ -0,0 +1,18 @@
+The application does not offer Two-Factor Authentication (2FA) as an option for user accounts. Without 2FA, account security relies only on the strength of the user's password, with no additional verification step to prevent unauthorized access. An attacker who obtains a user's password can access user's accounts, including those with access to sensitive data or administrative functions.
+
+**Business Impact**
+
+This vulnerability can lead to reputational damage and indirect financial loss to the company as customers may view the application as insecure.
+
+
+**Steps to Reproduce**
+
+1. Use a browser to navigate and log in at: {{URL}}
+1. Navigate to the account security settings at {{security_settings_url}}
+1. Confirm that no 2FA or multi-factor authentication option is available
+
+**Proof of Concept (PoC)**
+
+The screenshot(s) below demonstrate(s) the vulnerability:
+>
+> {{screenshot}}

submissions/description/insufficient_security_configurability/weak_jwt_hashing_algorithm/guidance.md

@@ -0,0 +1,7 @@
+# Guidance
+
+Provide a step-by-step walkthrough with a screenshot on how you exploited the vulnerability. This will speed triage time and result in faster rewards.
+
+For a broken authentication or session management vulnerability, please include a simple URL or HTTP payload that can be executed to easily demonstrate and reproduce the issue.
+
+Attempt to escalate the broken authentication or session management to perform additional actions (such as an account takeover or CSRF bypass to perform a sensitive action). If this is possible, provide a full Proof of Concept (PoC).