Medium Vulnerability Description:
WORKTERRA provides an interface for sending emails to administrators and WORKTERRA's customer support system. The backend does not rate-limit or validate the destination of these emails.
Impact:
A malicious user could use WORKTERRA servers as a spam delivery platform.
Verification and Attack Information:
Praetorian verified this finding by intercepting requests to the endpoint responsible for sending emails. A malicious user can modify the destination email address to any email address. Additionally, there are no controls in place to the number of emails sent within a given time frame. This finding was demonstrated by sending 50 emails to a test email account. The figure below shows that the emails are originating from WORKTERRA IP addresses.
Recommendation:
Validate the email's destination address on the server-side. Additionally, WORKTERRA should limit the number of emails that a user can send per-minute.
- relates to
-
ST-211 Restrict domain user for emails
-
- Closed
-
Pages for Testing
1] SA login --> Customizer
--> What Have We Done For You Lately
--> Generate report and click on Share Icon
2] First Enable "Write to your Benefits Administrator /HR" option from SystemSetting for company
--> Login with that company employee
--> Click On "Click Here" button on Homepage for "Write to your Benefits Administrator /HR"
Please test for ToEmailField(Enable/Disabled), do not test validations.
Assigning to Zeeshan
Note
"Completed working on hiding To emailID list on pages where To list text box was disabled. Changes has been checked In into LB.
Need to find customization for restricting user sending 50 emails in time frame. We should allow only 20 email in a minute from one domain user."
Code check-in on LB and Local for Candidate Feedback (via Candidate Login) and Removed Tomail field
Also Code enhanced with Page Specific Session for Employee Feedback as well as Candidate Feedback.
Candidate Login required to check that.
Niteen Surwase who is testing this?
Vijayendra ShindeZeeshan Chishty
Tested both the steps given by Niteen.
Working fine as expected.
Ready for Stage
Testing done on Stage for SA login and candidate log in functionality working properly.
But for Write to your Benefits Administrator /HR and Feedback about Benefits Enrollment System functionality not working as per implementation.
Reopening the ticket.
Thanks,
Venkatesh.
I have checked it on CSS for HSPL company employee and it is working correctly.
Please verify again.
Testing done on Stage for SA login and candidate log in functionality working properly. Employee log in Write to your Benefits Administrator /HR and Feedback about Benefits Enrollment System functionality also working fine.
Ready for Production.
Tested on Production with SA login server error is being displayed on click of send button.
Please refer attached screen shot.
Reopening the ticket
Hi Venkatesh Pujari,
This issue has been fixed on Production. It was due to configuration issue. Patch has been deployed on Production. You can verify this and close this ticket.
Thanks.
Testing in progress
Locations where changes needs to be done-
1)D:\WT\Trunk\Web\Web Projects\BenAdmin\Areas\Customization\Models\PlanDesign\PlanDesignEditContactModel.cs
2)WORKTERA HomeCompany HomeBenAdmin HomeBenAdmin Company HomeBenefit Providers
BenefitProviderModel.cs//
3)AdminUserPVModel.cs//
4)CompanyContactFormPVModel.cs //
5)SystemUserModel.cs//
6)QEEmailNotificationModel.cs// FROM/BCC
7)EmailMessageFormatModel.cs// from/bcc
8)EmpListAndEmailPVModel.cs//
9)IncompleteEnrollmentModel.cs//
10)/branches/Production/Web/Web Projects/WORKTERRA/Areas/Customization/Models/EDI/TemplateSettingsModel.cs
11)/branches/Production/Web/Web Projects/WORKTERRA/Areas/Customization/Models/EDI/TemplateDeliveryModel.cs
12)/branches/Production/Web/Web Projects/WORKTERRA/Areas/Customization/Models/EDI/GroupTemplateInformationModel.cs
13)/branches/Production/Web/Web Projects/WORKTERRA/Areas/Customization/Models/EDI/GroupTemplateDeliveryModel.cs
14)/branches/Production/Web/Web Projects/WORKTERRA/Scripts/ImportExportTemplateManagement_MVC.js
15)/branches/Production/Web/Web Projects/WORKTERRA/Scripts/GroupTemplateManagement.js
16)/branches/Production/Web/Web Projects/WORKTERRA/Areas/Customization/Views/Customization/EDI/TemplateSettings.cshtml
17)/branches/Production/Web/Web Projects/WORKTERRA/Areas/Customization/Views/Customization/EDI/TemplateDelivery.cshtml
18)/branches/Production/Web/Web 19)Projects/WORKTERRA/Areas/Customization/Views/Customization/EDI/GroupTemplateInformation.cshtml
20)/branches/Production/Web/Web Projects/WORKTERRA/Areas/Customization/Views/Customization/EDI/GroupTemplateDelivery.cshtml
21)/branches/Production/Web/Web Projects/BenAdmin/Areas/Customization/Views/Customization/BenefitProvider/AddBenefitProvider.cshtml