Security Advisory: Three Findings at prescreen.io and jobbase.io

On November 2nd of this year, security researchers from aramido identified the following gaps in the implementation of the applicant management applications prescreen.io and jobbase.io by Preescreen International GmbH:

• CWE-601 ‒ URL Redirection to Untrusted Site ('Open Redirect'):
  The application management tools of prescreen.io allowed open redirects to foreign websites. Malicious users could use this redirect function for an open redirect to a website that is not under Prescreen's control. For example, a phishing page could have been set up to which users could then be redirected via the open redirect.
• CWE-204 ‒ Response Discrepancy Information Exposure:
  The application management tools of prescreen.io revealed the email addresses with which users had registered by outputting different information for registered and unregistered email addresses during password reset. Attackers who, for example, wanted to carry out a phishing attack against Prescreen could use this information disclosure to test the validity of email addresses. Furthermore, the number of emails that could be sent to users for password reset seemed not to be limited. Attackers could have used this functionality to flood users' mail accounts with password reset emails. Both the candidate frontend jobbase.io and the company frontend prescreenapp.io were affected by this vulnerability.
• CWE-523 ‒ Unprotected Transport of Credentials:
  The application management tool of jobbase.io did not require users to change their initial password, which was also sent in an unencrypted email. When users of the Prescreen web application for candidates (jobbase.io) log in for the first time, they receive an initial password in an unencrypted email. If an attacker is in the same network as a candidate or has access to the mail server, they can intercept the password. Because jobbase.io did not immediately require users to change their password, attackers with the intercepted initial password could have accessed the user account and the personal documents of the candidate contained therein until the user changed the password of their own accord.

What should improvements in such cases look like?

To avoid open redirects, the value of the ref parameter should be validated before the redirect is executed. In general, open redirects to websites outside of one's own control should be rejected. To avoid providing attackers with information about user addresses, the error message for password reset should be formulated so that it allows no conclusions about the existence of a user account. To secure the access data, users should be able to set their own password during registration instead of being sent a machine-generated initial password. Alternatively, the lifetime of the token used for the first login should be limited.

According to aramido's process for the responsible disclosure of security vulnerabilities , Prescreen International GmbH followed our request for remediation in December and implemented it satisfactorily. The chronological sequence can be viewed as part of the security advisories formulated by aramido (aramido-2018-002, aramido-2018-003, aramido-2018-004).

The cloud-based applicant management software of Prescreen International GmbH can be operated by users via a web application. For users on the recruiting side, this is prescreen.io; for users on the applicant side, it is jobbase.io. Prescreen promises customers the possibility of centralizing applications, analyzing data, and facilitating evaluation through the software.