A technology company asked ioSENTRIX to test its web application, its backend APIs and the desktop agent its staff install.
Desktop agents fall between web and endpoint testing, so neither a web scanner nor an endpoint tool looks at the local connection between them. Finding this took testing the agent, the browser and the APIs together.
Also found: a hard-coded database password in the agent, server-side request forgery, missing cookie flags, a password-change endpoint open to brute force, an outdated library and weak TLS ciphers.
Any website could reach the desktop agent, and one stolen token could reach data across the platform.
The agent ran a local WebSocket server with no encryption, authentication or origin check. Any web page open in the user’s browser could connect and call sensitive agent functions and even make the machine scan the internal network.
Business impact. A malicious website could use the agent, and its reach into the internal network, on any staff machine with no user interaction.
The agent kept its sign-in token in plain text in memory, readable with standard tools and no admin rights. The token worked from any machine, defeating device registration, and missing ownership checks on the APIs let it open other accounts’ records and customer details.
Business impact. One compromised workstation could expose data across the entire platform.
We found that any website a user visited could control the agent through an unprotected local connection, and that a token read from memory bypassed device registration and opened data across the whole platform. The client closed every finding, and ioSENTRIX retested the fixes.
10+ findings in total, including 1 Critical and 2 High.
✓ Verification: All closed by the client; retested by ioSENTRIX.
A token copied from memory walked straight around device registration.
Any website can reach localhost unless you authenticate and check origin.
If a token can be copied, the device check can be skipped.
The ID in a request is the user’s claim, not proof (OWASP API1).
Details in this case study are anonymised and generalised. Methods that could harm other products are withheld.
A technology company asked ioSENTRIX to test its web application, its backend APIs and the desktop agent its staff install.
Any website could control the desktop agent. A malicious website could use the agent, and its reach into the internal network, on any staff machine with no user interaction.
10+ findings in total, including 1 Critical and 2 High.
All closed by the client; retested by ioSENTRIX.
Thick client and desktop application testing, delivered by the ioSENTRIX application and thick-client testers.
