Origination ApplicationID Enumeration

These updates are applicable for releases - 2021.04, 2021.07, 2021.10, 2022.07, 2022.10, 2023.01, 2023.07, 2023.10.

Description

This document provides a solution to prevent authenticated users from enumerating valid application IDs within the system by performing brute force attacks on the application endpoint.

It was observed that an authenticated user can enumerate the valid application IDs present in the application by brute forcing the application endpoint.

For instance, an authorized user can brute force the endpoint with a list of random application IDs to enumerate all valid application IDs in the application.

Affected Parameter:

applicationId

Affected URL:

https://temenosupgradetwo.temenos-cloud.net/services/data/v1/ApplicationManagement/operations/ApplicationJourney/getApplicationTypeById OriginationBy exploiting this vulnerability, a malicious authenticated user can enumerate the valid application IDs present in the application.

Recommendation

Application must have a robust authorization mechanism wherein the privileges of logged in user (whose identity is ascertained using the session ID) is ascertained at the server end prior to granting access to use specific data or privileged functionalities.

Solution

Path:

Fabric/java/OnboardingCommons/src/main/java/com/temenos/onboarding/commons/javaservice/GetApplicationType.java

Package: com.temenos.onboarding.commons.javaservice.GetApplicationType.java

Class: GetApplicationType.java

Method: Invoke

In the snippets, red indicates removed or modified content, while green indicates added or replaced content.

As shown in the above snip, add the following line in the method.

JSONArray coApplicants = applicationMetaData.getJSONArray("CoApplicants"); 
List coApplicantsDigitalProfileIds = null; 
if(coApplicants.length()>0) { 
coApplicantsDigitalProfileIds = new ArrayList(); 
for(int i = 0;i 
coApplicantsDigitalProfileIds.add(coApplicants.getString(i).split("_")[1]); 
} 
} 

As shown in the above snip, add the following line in the method.

if (!((loggedIdDigitalProfileId.equalsIgnoreCase(applicationDigitalProfileId)) 
|| ((coApplicantsDigitalProfileIds != null &&
coApplicantsDigitalProfileIds.size() > 0 
&& (coApplicantsDigitalProfileIds.contains(loggedIdDigitalProfileId)))))) {

As shown in the above snip, add the following line in the method.

result.removeParamByName("entityDefinitionCode"); 
if(result.hasParamByName("errmsg")) { 
result.removeParamByName("errmsg"); 
} 
com.temenos.onboarding.commons.utils.CommonUtils.withErrorParams(result); 
return result;