with reference to TS020728795, Concurrent login enabled, Inadequate input validation, Session doesn’t Expire Post Changing Password issues found in OnDemand Penetration test

Item

Issue Description

Impact

Recommendation

IBM feedback

1

Concurrent login enabled:
The test team observed that the application allows concurrent login attempts through the client.
We were able to run two concurrent sessions from same workstation using the same credential set.

An adversary can get hold of a logged application client if the
adversary has physical access to the workstation on which
victim has previously logged in. That session can be
concurrently run by the adversary without the victim having
knowledge of it. This can lead to unauthorized access to the
data and misuse of privileges.

It is recommended to not allow concurrently sessions for users

Working as designed. Do not consider this to be a security threat.

2

Inadequate input validation:
The test team observed that the server accepts special characters in the notes feature in the application. Any user who access that file will be able to view those characters.
Note: This issue is present throughout the application where the user has ability to add notes.

An adversary might inject a malicious code using special
characters in the notes section and try to perform malicious
code execution on the platform it is downloaded or utilized. For
e.g. If the notes are imported to a .csv file, it can cause CSV
injection. If it is loaded on a browser as an html document, it
can lead to Cross Site Scripting etc

It is recommended to disallow the usage of special characters and only a set of allowed special characters which are required by the application should be whitelisted.

CMOD prevents the execution of any character input. Any such input that occurs outside of CMOD is a customer environment issue

3

Session doesn’t Expire Post Changing Password:
The test team observed that the user is not logged out of the session after changing the password. Also, if there is any concurrent session running for a user in another window, both the sessions stay active when the user changes the password from any of those sessions.

An adversary might leverage this issue and will be able to run
concurrent sessions even after the user changes the
password. The user would have no knowledge of the running
session

It is recommended to kill all the active sessions for the user once the user changes the password. The user should relogging after changing the password

Working as designed. Do not consider this to be a security threat.