Unimus security — penetration test report 2022

Overview

High severity issues

A1) Post-auth stored XSS/HTML injection allows JavaScript code execution in the Unimus web GUI

Medium severity issues

B1) Insecure Direct Object Reference (IDOR) in the Unimus API

B2) No expiration on JWT tokens for the Unimus API

B3) Session fixation allows theft of session cookie in special cases in the Unimus web GUI

B4) Response time based account enumeration allows to find valid application login names in the Unimus web GUI

Low severity issues

C1) No Function Limiting in the Unimus API

C2) Invalid Credential UUID Accepted For Delete in the Unimus API

C3) Missing Lock Out in the Unimus API

C4) No account lock out policy allows password guessing attacks in the Unimus web GUI

The outro

--

--

Love podcasts or audiobooks? Learn on the go with our new app.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store