Detecting the Denial of Service attacks in openIMIS

May 29, 2024

Łukasz Ruzicki

We uncovered critical vulnerabilities related to Denial of Service (DoS) attacks in openIMIS, a management information system used for managing health insurance data.

In this real-life example, we delve into the specifics of these vulnerabilities and their potential impact. DoS attacks aim to disrupt services, networks, or applications by overwhelming them with excessive requests or other forms of disruption. Our analysis provides a detailed framework for understanding these vulnerabilities and how they were identified.

Significance

A Denial of Service (DoS) attack targeting the openIMIS application can lead to significant consequences. The system’s primary function is to manage insurance information, claims, and benefits. A successful attack could lead the system unavailable, causing service disruptions and preventing users from accessing essential services.

This not only leads to financial losses for the organizations relying on openIMIS but also affects beneficiaries who depend on the system for healthcare or insurance services. Furthermore, such an attack can damage trust, causing reputational damage to both the openIMIS system and its associated organizations. Additionally, recovery efforts post-attack can lead to operational delays, slowing down the return to normal operations and further impacting the overall system and its users.

Testing and discovery

Testing approach

Our penetration testing framework, an enhanced version of the OWASP checklist tailored for web applications, guided our systematic approach to evaluating the security of openIMIS.

Initially, our team leveraged our extensive experience with the system to gather information and prepare attack vectors specifically designed to uncover vulnerabilities within openIMIS. Following this tailored threat modeling, we employed a suite of automated tools to scan and assess the overall state of the system’s security. This combination of expert knowledge and verified testing tool ensures comprehensive coverage and precision in identifying potential security weaknesses.

At Soldevelo, our comprehensive software security services include advanced penetration testing and security audits tailored to uncover and mitigate vulnerabilities in systems like openIMIS.

Discovery

During the testing phase, our focus was broad yet targeted, encompassing a variety of potential security issues outlined in our testing framework:

Role definitions: We evaluated role definitions in the system, ensuring proper access levels were assigned and enforced.
User registration: The user registration process was scrutinized to prevent unauthorized registrations.
Account provisioning: We tested the account provisioning process, verifying that only authorized users could create new accounts.
Account enumeration and username policy: We checked for vulnerabilities related to account enumeration and guessable usernames.
GraphQL security: We assessed the configuration of GraphQL to ensure a secure and ready deployment.
Input validation: We validated all input fields against generic attacks, including SQL injection and cross-site scripting.
Access controls: We verified that proper access controls were applied to prevent unauthorized access and privilege escalation.

Our extensive experience and sophisticated security tools make us adept at identifying and addressing a wide range of potential security issues, ensuring robust protection for web applications.

The discovery process revealed several critical vulnerabilities, notably:

Input limitation: The insuree search function lacked input limitations, making it vulnerable to injection attacks.
Rate limiter: None of the tested functionalities had a rate limiter configured, exposing the system to potential DoS attacks by overwhelming it with requests.
Self-deprovisioning: Administrators were able to self-deprovision in test account setups, potentially leading to DoS incidents and rendering the system unusable for other users.

Vulnerability analysis and mitigation

In this section, we discuss the vulnerabilities uncovered in the openIMIS application, analyzing each issue individually and providing a comprehensive overview of its discovery, potential impact, recommended solutions, and real-world resolutions. Through these case studies, we aim to showcase the multifaceted nature of cybersecurity, where vulnerabilities must be handled with precision, often requiring a balance between ideal solutions and practical implementations.

Missing rate limiter

How we tested it

We conducted a detailed security assessment to identify vulnerabilities related to Denial of Service (DoS) attacks in the openIMIS web application. Our testing approach included:

Intercepting requests using Burp Suite to analyze the behavior of the system under load.
Simulating multiple requests to observe if the system implemented any rate limiting measures.
Evaluating the system’s response to excessive requests to determine the risk of DoS attacks.

How we found it

During our assessment, we discovered that the system lacked a rate limiter on its functionalities, exposing it to potential brute force attacks and DoS scenarios. Specifically:

We intercepted a home page request or any other request from the web application using Burp Suite.
By setting Burp Suite as a proxy for the browser, we began intercepting requests.
Using Burp Suite’s “Intruder” tab, we sent multiple requests to the application without encountering any rate limiting measures.
This simple test demonstrated how an attacker could easily overwhelm the system, leading to a DoS attack that prevents legitimate users from accessing essential services.

Impact

Likelihood: High, due to the absence of a rate limiting mechanism.
Impact: High, as it can result in legitimate users being unable to access the site, disrupting service continuity.

Recommendations and mitigations

Rate limiter implementation:

A rate limiter is integrated across all critical functionalities, particularly those that do not require prior authentication, such as login and password reset processes.
The initial rate limit is set to no more than 100 requests per user within an hour, providing a balanced approach to security and usability. This setting ensures that the system can handle legitimate traffic while mitigating the risk of abuse.

Phased approach to rate limiting:

In the first phase, rate limiting focuses on high-risk functionalities like login and password reset to address immediate threats effectively.
Subsequently, rate limiting extends to all functionalities, ensuring comprehensive protection across the entire system.

By adopting these measures, openIMIS enhances its protection against DoS attacks, ensuring system reliability and availability, and safeguarding the continuity of essential services.

Lacks of input limitation

How we tested it

We conducted a thorough examination of the insuree search functionality on the main page of the openIMIS web application to identify any input validation vulnerabilities. Our testing approach included:

Submitting various input sizes to the insuree search field to observe the system’s behavior.
Using automated tools and manual testing methods to check for the absence of input limits.
Monitoring the server’s response to determine its ability to handle large payloads.

How we found it

During our assessment, we discovered a DoS vulnerability due to the lack of input validation in the insuree search field:

Input validation test: By entering an excessively large number of characters into the insuree search field, we observed that the server struggled to process the request.
Payload size analysis: We submitted requests with payload sizes significantly larger than the expected length for insuree numbers. This led to delays and eventual denial of service, confirming the absence of adequate input validation mechanisms.

Impact

Likelihood: Low, as it requires deliberate misuse by entering excessively large inputs.
Impact: High, as it can lead to a Denial of Service, preventing legitimate users from accessing the application.

Recommendations and mitigations

Input validation implementation:

Numeric character restriction:
- The input for the insuree search field is restricted to only numeric characters, preventing any non-numeric input that could potentially cause issues.
Character limit:
- A character limit is imposed on the insuree search field to match the maximum length expected for insuree numbers. This prevents oversized requests that could overwhelm the server.

Backend validation:

Comprehensive backend security:
- Ensuring that backend validation is in place to act as the last line of defense. Even if frontend validation is bypassed, the backend checks and secures the input against any code injection and large parameter processing.
Request size limitation:
- Additional checks on the backend to monitor the size of parameters and the overall request. By enhancing the default limits, the system prevents the creation of resource-consuming queries that could impact server performance.

By integrating these measures, openIMIS ensures robust input validation, protecting against potential DoS attacks and maintaining the availability and performance of the system for legitimate users. This comprehensive approach to input limitation and validation reinforces the overall security and reliability of the application.

Administrator self-deprovisioning

How we tested it

We conducted a targeted assessment of the role management functionality within the openIMIS web application to identify any vulnerabilities related to administrator privileges. Our testing approach included:

Exploring the user role management interface to identify actions that administrators can perform on their accounts.
Attempting to modify the role list of an administrator account to observe if self-deprovisioning is possible.
Monitoring the system’s response to changes in administrator roles.

SolDevelo’s targeted security assessments ensure that role management functionalities are securely implemented, preventing vulnerabilities that could disrupt system operations.

How we found it

During our assessment, we discovered a significant vulnerability where administrators could self-deprovision their accounts:

Role modification test: By accessing the role management interface, we attempted to change the role list of an administrator account.
Successful deprovisioning: We successfully deprovisioned an administrator account, resulting in the loss of access to the application and instance.
No tools required: This vulnerability was confirmed without the need for any specialized tools, demonstrating how easily it could be exploited.

Impact

Likelihood: Low, as it requires deliberate misuse by an administrator.
Impact: High, as it can lead to a Denial of Service (DoS) incident, severely affecting system availability and reliability.

Recommendations and mitigations

Blocking self-deprovisioning:

Role change restrictions:
- Implement restrictions within the role management functionality to prevent administrators from self-deprovisioning their accounts. This ensures that administrators cannot remove their own access privileges.
Validation checks:
- Introduce validation checks to confirm that the deprovisioned user is not an administrator. Additionally, ensure that administrators cannot modify their own roles in a way that would result in self-deprovisioning.

By implementing these measures, openIMIS enhances its security posture, preventing administrators from inadvertently or maliciously causing a Denial of Service by self-deprovisioning their accounts. This approach ensures that the system remains reliable and accessible, maintaining the integrity of administrative functions.

Technologies used

OWASP WSTG: The OWASP Web Security Testing Guide (WSTG) provided a structured and comprehensive framework for evaluating the security of the openIMIS application.

Burp Suite: Burp Suite was employed as a key tool for intercepting and analyzing requests, simulating multiple requests, and testing for rate limiting measures.

Better safe than sorry

By partnering with SolDevelo, you can benefit from our extensive expertise in software security services, ensuring your systems are robust and secure against various threats.