Save this case study in PDF
Download PDFClient
A global provider of software engineering, technology consulting, and quality assurance services, renowned for delivering innovative and high-quality solutions. Operating across multiple industries, this company helps businesses transform their operations with cutting-edge technology. Their extensive portfolio includes custom software development, product design, data science, and digital transformation services for clients worldwide.
Background
As the company’s operations expanded, so did the complexity of their external network environment. They maintained a range of public-facing services, including VPN servers, collaborative platforms like Jira and Confluence, and various websites accessible outside the company’s perimeter. Recognizing the increasing threat landscape and the critical importance of safeguarding sensitive data, they sought to strengthen their cybersecurity posture, particularly concerning their demilitarized zones (DMZ) and external services. Additionally, annual compliance and certification standards mandated a thorough yearly assessment of these external-facing services, making robust security measures a top priority.
The Challenge
The company engaged Iterasec to achieve several key objectives:The Solution
Iterasec deployed a team of seasoned security professionals to execute a multi-phased penetration testing and security enhancement program.
External Network Penetration Testing
-
Scope Definition:
Identified all external assets, including VPN endpoints, web applications, and public services like Jira, Confluence, and various company websites.
-
Vulnerability Scanning and Exploitation:
Utilized advanced tools and manual techniques to scan for vulnerabilities such as outdated software versions, misconfigurations, and exposed services.
-
Exploitation of Critical Vulnerabilities:
Focused on exploiting vulnerabilities that could lead to significant security breaches, including unauthorized access to internal networks.
Discovery of Critical GLPI Vulnerability
-
Bypass Authentication:
Exploit an authentication bypass flaw to gain unauthorized access to the GLPI system.
-
Remote Access to Workstations:
Utilize GLPI's FusionInventory plugin to remotely access and control any workstation within the company network without administrative credentials.
-
Potential for Full Compromise:
Highlight the risk where an attacker could deploy backdoors or ransomware across the company's infrastructure using GLPI's software deployment functionalities.
In-depth Vulnerability Research
-
Source Code Analysis:
Performed a comprehensive review of GLPI's publicly available source code to understand the root cause of the vulnerability.
-
Discovery of New CVE (CVE-2021-21327):
Identified a new vulnerability classified as CWE-470 (Use of Externally-Controlled Input to Select Classes or Code), which affected all GLPI instances up to version 9.5.3.
-
Responsible Disclosure:
Coordinated with the GLPI development team to report the vulnerability, leading to the issuance of CVE-2021-21327 and the release of a patched version (GLPI 9.5.4).
Remediation Support
-
Immediate Mitigation:
Advised the company on temporary measures to secure their GLPI instance until a permanent fix was applied.
-
Patch Implementation:
Assisted in updating GLPI to the latest secure version and reconfiguring settings to enhance security.
-
System Hardening:
Provided recommendations on securing other external services by updating software, fixing misconfigurations, and enhancing monitoring.
Iterative Testing and Validation
-
Follow-up Assessments:
Conducted additional penetration tests to verify the effectiveness of remediation efforts.
-
Continuous Monitoring:
Established protocols for regular security assessments to proactively identify and address new vulnerabilities.
The Outcome
Our engagement led to substantial improvements in the company's security posture:Conclusion
Our collaboration underscores Iterasec’s expertise in delivering advanced cybersecurity solutions for complex environments, where thorough penetration testing and deep vulnerability research enabled us to uncover and address critical security issues that standard assessments might miss. By leveraging our proactive approach and technical acumen, the company maintained client trust through the safeguarding of sensitive information, enhanced its security infrastructure without disrupting operations, and stayed ahead of emerging threats via continuous improvement. This case highlights the need to address known vulnerabilities while actively seeking unknown risks and reaffirms Iterasec’s commitment to partnering with organizations to protect their assets and support mission-critical objectives.