The web applications, especially of government organizations are prone to malicious attacks intending defamation, service disruption and data corruption. Protection and management of its external facing infrastructure is thus critically important for securing applications and government data.
External facing infrastructures often be-come the attack surface for malicious users. A web-hosting organiza-tion undertakes several steps to keep its infrastructure and services secure, ranging from deploying firewalls to patch management. Security testing process allows revealing the flaws in the security mechanisms of an infor-mation system that protect data and maintain functionality as intended. Security requirements include confi-dentiality, integrity, authentication, availability, authorization and non-repudiation. However, one step that is often overlooked is performing effec-tive Vulnerability Management of its network resources, hosting infrastruc-ture and application services. The security posture of an organization can be assessed based on vulnerabili-ties. Even the most secure network is likely to have some unknown vulnera-bilities. Vulnerability is a weakness in a program that can lead to an exploit and breach of the network or services by malicious users (attackers). Many cyber-attacks take advantage of basic, often unnoticed security vulnerabili-ties, such as poor patch management procedures, weak passwords, insecure configurations and non-compliance to sound security policies. This makes an effective Vulnerability Management a critical step in the effort to protect data. Regular vulnerability assessments are also essential because the security threats continually change and evolve. A public facing application might be secure today, but it could become completely vulnerable tomorrow. This is simply because an attacker would have discovered a previously unknown attack.
VULNERABILITY MANAGEMENT Vulnerability Management is a se-curity approach to find and mitigate known vulnerabilities by using the se-curity scanners. This process provides in-depth evaluation of the information security posture, indicating weakness-es as well as providing the appropriate mitigation procedures required to either eliminate those weaknesses or reduce them to an acceptable level of risk. Vulnerability assessment is the initial process of identifying and quantifying security vulnerabilities in an environ-ment. Vulnerability Assessments follow these general steps : • Catalog assets and resources in a system • Manage assets to maintain vulnerabilities, this requires need to identify the resources attached to the network such as the IP Address database • Assign quantifiable value and importance to the resources • Identify the security vulnerabili-ties or potential threats to each re-source using vulnerability scanners
• Validate and prioritize the VA scanner reported vulnerabilities that need to be fixed VA scanner runs for defined network IPs to find the vulnerabilities. Mitiga-tion or elimination of the vulnerabili-ties needs to be performed by the ad-ministrators. This process of scanning and mitigation should ideally be iterat-ed till patches are fixed completely. In order to perform periodic assessment, this process is usually scheduled to as-sess the security posture at pre-defined intervals. VA scanners are useful tools for identifying hidden network and host vulnerabilities. Host based scanners have direct ac-cess to the file system on the target host and thus the capability to find low level information on the system like exact version of software installed and services and configuration. These can therefore provide insight into user activities such as using easily guessa-ble passwords or even no password. These can also detect signs that an at-tacker has already compromised a sys-tem, including looking for suspicious file names, unexpected new system files or device files and unexpected privileged programs. Host-based scan-ners can also perform baseline (or file system) checks.
SECURITY OF CMS APPLICATIONS In several applications, a layer above the web server, i.e., the Content Man-agement System (CMS) is used in soft-ware building for rapid application de-velopment. CMS based applications follow the agile methodology to de-velop applications. These have gained popularity due to their ease of use to create applications. However, mali-cious adversaries often exploit vulner-abilities within the CMS installed on the web servers of organization. Also, the source code of most popular open source CMSs are publicly available, and can be easily targeted. Once the CMS has been compromised, the web server can be used as infrastructure to facilitate targeted intrusion attempts. These CMSs may usually be con-sidered low priority in assessment of the security posture of organization. Available VA Scanners usually run for different vulnerabilities of the entire web-stack, as one vulnerable compo-nent could compromise the security of the other layers. Vulnerability man-agement scopes assessing of the op-erating system, webserver, database server, third-party applications or cus-tom site-specific code scanning is not sufficient. The assessment of the CMS is more critical since applications and their usage are completely dependent on the CMS. Once a CMS has been compromised, adversaries can exploit their access to: • Obtain access to authenticated and privileged areas of the site. • Upload malware to the webserver to facilitate remote access, Web-Shells etc. • Inject malicious content into le-gitimate web pages. This could be used to server exploits or malware to visitors or to facilitate infrastruc-ture access remotely.
CASE STUDY Application vulnerabilities in CMS infrastructure level - JOOMLA JOOMLA is one of the popular CMS. Different versions of Joomla have different vulnerabilities. Some of these are 0-day vulnerabilities. 0-day attacks are exploits of newly discovered vulnerabilities, caused either before being disclosed to the public or before the necessary patch for the exploit has been applied. Consider the following example of hardened webserver and OS installed with Joomla CMS. Older versions of the Joomla CMS application have security issues in ‘com_contenthistory’ module. The screenshot of the Joomla com_contenthistory shows vulnerability finding using SQL Injection.
This allows compromising all security layers built for these applications.
TESTING OF CMS WITHIN VA SCOPE In the Vulnerability Management process, the VA Scanner for web ap-plications / network also may not give good results for CMS based applica-tions. In most cases, the core CMS applica-tion may not be tested thoroughly for vulnerabilities. A Common cause of cyber intrusion is running outdated CMS software/untested CMS. These CMSs targeted by attackers lead to zero-day exploits. Vendors may test for security vulnerabilities and re-lease relevant patches, but this mitiga-tion may take time, since patches need to be tested before going to pro-duction. If a VA Scanner is not able to identify the vulnerable issues, then the security team performs manual security testing periodically and manages CMS secu-rity vulnerabilities using built vulnera-bility finding scripts.
CONCLUSION As part of web hosting security vulner-ability Management process, it is nec-essary to consider the CMS vulnera-bilities checked periodically in order to assess the organization’s security posture. It is also suggested to script the de-ployment of security tools so that all environments have baseline coverage and run regular vulnerability scans against the environments and remediate any vulnerability.