[ST-107] Web Security: INTERNAL IP ADDRESS REVEALED - Workterra Jira

Details

Type: Enhancement
Status: Closed
Priority: High
Resolution: Done
Component/s: BenAdmin
Labels:
- Security

Module:
BenAdmin - Security
Reported by:
Support
Item State:
Production Complete - Closed
Issue Importance:
Must Have
Sprint:
ST Sprint 1

Description

An internal IP address was returned within the response HTML. While not always visible in the rendered HTML, it was visible within the HTML source.

Attachments

Options
- Sort By Name
- Sort By Date
- Ascending
- Descending
- Thumbnails
- List
- Download All

Attachments

Internal IP revealed.jpg
25/Apr/16 12:44 PM
111 kB
Zeeshan Chishty

Issue Links

is blocked by

ST-169 Internal IP revealed-related to ST-107

Closed

Activity

Ascending order - Click to sort in descending order

Samir created issue - 23/Mar/16 11:32 AM

Samir made changes - 23/Mar/16 11:33 AM

Field	Original Value	New Value
Status	New Request [ 10029 ]	Pending for Approval [ 10002 ]

Samir made changes - 23/Mar/16 11:33 AM

Status

Pending for Approval [ 10002 ]

Approved for Development [ 10003 ]

Samir made changes - 23/Mar/16 11:33 AM

Assignee

Niteen Surwase [ niteen.surwase ]

Niteen Surwase (Inactive) made changes - 04/Apr/16 11:15 AM

Status

Approved for Development [ 10003 ]

In Development [ 10007 ]

Niteen Surwase (Inactive) made changes - 04/Apr/16 11:15 AM

Status

In Development [ 10007 ]

Local Testing [ 10200 ]

Hide

Permalink

Niteen Surwase (Inactive) added a comment - 04/Apr/16 11:18 AM - edited

In earlier scenarios Server IPs were visible in following files. This is resolved in this ticket.

Please check following File Paths :
1. AddXpress Company module - Upload logo and check for IP by inspecting logo.
2. ConfigureLandingPage - Upload Image and check for IP by inspecting Image.
3. IncompleteEnrollmentNotifications - Upload File and check for IP by inspecting file link.

Show

Niteen Surwase (Inactive) added a comment - 04/Apr/16 11:18 AM - edited In earlier scenarios Server IPs were visible in following files. This is resolved in this ticket. Please check following File Paths : 1. AddXpress Company module - Upload logo and check for IP by inspecting logo. 2. ConfigureLandingPage - Upload Image and check for IP by inspecting Image. 3. IncompleteEnrollmentNotifications - Upload File and check for IP by inspecting file link.

Niteen Surwase (Inactive) made changes - 04/Apr/16 11:18 AM

Assignee

Niteen Surwase [ niteen.surwase ]

Amit Gude [ amitg ]

Samir made changes - 05/Apr/16 05:56 AM

Sprint

ST Sprint 1 [ 1 ]

Samir made changes - 05/Apr/16 05:56 AM

Rank

Ranked higher

Hide

Permalink

Amit Gude (Inactive) added a comment - 20/Apr/16 09:03 AM

Assigning to Zeeshan

Show

Amit Gude (Inactive) added a comment - 20/Apr/16 09:03 AM Assigning to Zeeshan

Amit Gude (Inactive) made changes - 20/Apr/16 09:03 AM

Assignee

Amit Gude [ amitg ]

Zeeshan Chishty [ zeeshan.chishty ]

Zeeshan Chishty (Inactive) made changes - 25/Apr/16 12:44 PM

Attachment

Internal IP revealed.jpg [ 16153 ]

Hide

Permalink

Zeeshan Chishty (Inactive) added a comment - 25/Apr/16 12:44 PM

Show

Zeeshan Chishty (Inactive) added a comment - 25/Apr/16 12:44 PM

Hide

Permalink

Zeeshan Chishty (Inactive) added a comment - 25/Apr/16 12:48 PM

Not Verified as Internal IP addresses was revealed in error response to Employee Feedback file upload and sent mail.
But when tested in Praetorian Identified vulnerable response the issue is fixed for below page.
/BenAdmin/UserDetails/UserDetails/IncompleteEnrollmentNotification

Show

Zeeshan Chishty (Inactive) added a comment - 25/Apr/16 12:48 PM Not Verified as Internal IP addresses was revealed in error response to Employee Feedback file upload and sent mail. But when tested in Praetorian Identified vulnerable response the issue is fixed for below page. /BenAdmin/UserDetails/UserDetails/IncompleteEnrollmentNotification

Zeeshan Chishty (Inactive) made changes - 25/Apr/16 12:48 PM

Status

Local Testing [ 10200 ]

Reopen in Local [ 10018 ]

Samir made changes - 13/May/16 07:42 AM

Issue Importance

Must Have [ 11800 ]

Zeeshan Chishty (Inactive) made changes - 19/May/16 09:57 AM

Assignee

Zeeshan Chishty [ zeeshan.chishty ]

Niteen Surwase [ niteen.surwase ]

Zeeshan Chishty (Inactive) made changes - 19/May/16 09:57 AM

Labels

Security

Zeeshan Chishty (Inactive) made changes - 19/May/16 10:03 AM

Link

This issue is blocked by ~~ST-169~~ [ ~~ST-169~~ ]

Vijayendra Shinde (Inactive) made changes - 31/May/16 05:30 AM

Module

Parent values: BenAdmin(10100)

Parent values: BenAdmin(10100)Level 1 values: Security(10112)

Niteen Surwase (Inactive) made changes - 20/Jun/16 02:12 PM

Assignee

Niteen Surwase [ niteen.surwase ]

Zeeshan Chishty [ zeeshan.chishty ]

Niteen Surwase (Inactive) made changes - 20/Jun/16 02:12 PM

Status

Reopen in Local [ 10018 ]

In Development [ 10007 ]

Hide

Permalink

Niteen Surwase (Inactive) added a comment - 01/Jul/16 11:10 AM

Hi Zeeshan Chishty

We were not able to reproduce this issue. So, please approve implemented issue for stage

Show

Niteen Surwase (Inactive) added a comment - 01/Jul/16 11:10 AM Hi Zeeshan Chishty We were not able to reproduce this issue. So, please approve implemented issue for stage

Niteen Surwase (Inactive) made changes - 01/Jul/16 11:10 AM

Item State

Parent values: LB QA(10201)Level 1 values: LB Deployed(11600)

Niteen Surwase (Inactive) made changes - 01/Jul/16 11:10 AM

Status

In Development [ 10007 ]

Local Testing [ 10200 ]

Zeeshan Chishty (Inactive) made changes - 04/Jul/16 05:41 AM

Item State

Parent values: LB QA(10201)Level 1 values: LB Deployed(11600)

Parent values: LB QA(10201)Level 1 values: Ready for Stage(10213)

Zeeshan Chishty (Inactive) made changes - 04/Jul/16 05:41 AM

Status

Local Testing [ 10200 ]

Pending for Stage Approval [ 10300 ]

Hide

Permalink

Zeeshan Chishty (Inactive) added a comment - 05/Jul/16 09:23 AM

Hi Rakesh Roy We can close this ticket as we are not able to reproduce this issue.
When tested in Praetorian Identified vulnerable response page the issue is fixed and no internal IP is revealed.

Show

Zeeshan Chishty (Inactive) added a comment - 05/Jul/16 09:23 AM Hi Rakesh Roy We can close this ticket as we are not able to reproduce this issue. When tested in Praetorian Identified vulnerable response page the issue is fixed and no internal IP is revealed.

Zeeshan Chishty (Inactive) made changes - 05/Jul/16 09:23 AM

Assignee

Zeeshan Chishty [ zeeshan.chishty ]

Rakesh Roy [ rakeshr ]

Rakesh Roy (Inactive) made changes - 07/Jul/16 09:51 AM

Assignee

Rakesh Roy [ rakeshr ]

Deepali Tidke [ deepalit ]

Hide

Permalink

Deepali Tidke (Inactive) added a comment - 07/Jul/16 10:05 AM

as per above comments closing this ticket

Show

Deepali Tidke (Inactive) added a comment - 07/Jul/16 10:05 AM as per above comments closing this ticket

Deepali Tidke (Inactive) made changes - 07/Jul/16 10:07 AM

Item State

Parent values: LB QA(10201)Level 1 values: Ready for Stage(10213)

Parent values: Production Complete(10222)Level 1 values: Closed(10223)

Deepali Tidke (Inactive) made changes - 07/Jul/16 10:07 AM

Status

Pending for Stage Approval [ 10300 ]

Approved for Stage [ 10030 ]

Deepali Tidke (Inactive) made changes - 07/Jul/16 10:07 AM

Status

Approved for Stage [ 10030 ]

Stage Testing [ 10201 ]

Deepali Tidke (Inactive) made changes - 07/Jul/16 10:07 AM

Status

Stage Testing [ 10201 ]

Pending for Production Approval [ 10301 ]

Deepali Tidke (Inactive) made changes - 07/Jul/16 10:07 AM

Status

Pending for Production Approval [ 10301 ]

Approved for production [ 10034 ]

Deepali Tidke (Inactive) made changes - 07/Jul/16 10:07 AM

Status

Approved for production [ 10034 ]

Production Testing [ 10202 ]

Deepali Tidke (Inactive) made changes - 07/Jul/16 10:07 AM

Resolution		Fixed [ 1 ]
Status	Production Testing [ 10202 ]	Production Complete [ 10028 ]

Deepali Tidke (Inactive) made changes - 07/Jul/16 10:07 AM

Status

Production Complete [ 10028 ]

Closed [ 6 ]

Niteen Surwase (Inactive) made changes - 18/Jul/16 07:22 AM

Item State

Parent values: Production Complete(10222)Level 1 values: Closed(10223)

Parent values: LB QA(10201)

Niteen Surwase (Inactive) made changes - 18/Jul/16 07:22 AM

Item State

Parent values: LB QA(10201)

Parent values: LB QA(10201)Level 1 values: LB Deployed(11600)

Hide

Permalink

Niteen Surwase (Inactive) added a comment - 18/Jul/16 07:24 AM

Hi Deepali Tidke

Make it ready for stage for implemented change.
For more discussion approach me.

Show

Niteen Surwase (Inactive) added a comment - 18/Jul/16 07:24 AM Hi Deepali Tidke Make it ready for stage for implemented change. For more discussion approach me.

Niteen Surwase (Inactive) made changes - 18/Jul/16 07:25 AM

Developer

Niteen Surwase [ niteen.surwase ]

Hide

Permalink

Deepali Tidke (Inactive) added a comment - 18/Jul/16 08:40 AM

Kindly discuss with Niteen for more details

Show

Deepali Tidke (Inactive) added a comment - 18/Jul/16 08:40 AM Kindly discuss with Niteen for more details

Deepali Tidke (Inactive) made changes - 18/Jul/16 08:40 AM

Assignee

Deepali Tidke [ deepalit ]

Kunal Kedari [ kunal.kedari ]

Kunal Kedari (Inactive) made changes - 20/Jul/16 05:44 AM

Item State

Parent values: LB QA(10201)Level 1 values: LB Deployed(11600)

Parent values: LB QA(10201)Level 1 values: In Testing(10210)

Hide

Permalink

Kunal Kedari (Inactive) added a comment - 20/Jul/16 05:54 AM

Hi Niteen Surwase,

We have verified the mentioned change on local (wt-stage), we inspected the mentioned pages and check whether internal IP is displaying anywhere. After fix internal IP address is not displaying anywhere. Along with this we have also perform sanity testing for mentioned pages as well, no issue found during sanity. We can deploy the change to Stage.

Show

Kunal Kedari (Inactive) added a comment - 20/Jul/16 05:54 AM Hi Niteen Surwase , We have verified the mentioned change on local (wt-stage), we inspected the mentioned pages and check whether internal IP is displaying anywhere. After fix internal IP address is not displaying anywhere. Along with this we have also perform sanity testing for mentioned pages as well, no issue found during sanity. We can deploy the change to Stage.

Kunal Kedari (Inactive) made changes - 20/Jul/16 05:54 AM

Item State

Parent values: LB QA(10201)Level 1 values: In Testing(10210)

Parent values: LB QA(10201)Level 1 values: Ready for Stage(10213)

Rakesh Roy (Inactive) made changes - 08/Aug/16 03:55 AM

Item State

Parent values: LB QA(10201)Level 1 values: Ready for Stage(10213)

Parent values: Production Complete(10222)Level 1 values: Closed(10223)

Vijayendra Shinde (Inactive) made changes - 15/Dec/20 02:40 AM

Link

This issue relates to DEV-13718 [ DEV-13718 ]

Transition	Time In Source Status	Execution Times

Samir made transition - 23/Mar/16 11:33 AM

New Request

Pending for Approval

1m 3s

Samir made transition - 23/Mar/16 11:33 AM

Pending for Approval

Approved for Development

Niteen Surwase (Inactive) made transition - 04/Apr/16 11:15 AM

Approved for Development

In Development

11d 23h 41m

Zeeshan Chishty (Inactive) made transition - 25/Apr/16 12:48 PM

In LB Testing

Reopen in Local

21d 1h 33m

Niteen Surwase (Inactive) made transition - 20/Jun/16 02:12 PM

Reopen in Local

In Development

56d 1h 24m

Niteen Surwase (Inactive) made transition - 01/Jul/16 11:10 AM

In Development

In LB Testing

10d 20h 57m

Zeeshan Chishty (Inactive) made transition - 04/Jul/16 05:41 AM

In LB Testing

Pending for Stage Approval

2d 18h 30m