Question

WEB APPLICATION ACCESS WITHOUT AUTHENTICATION

0

Hi, There is a security issue captured in the penetration test. Issue tells that, any page present inside the deployment\web\pages directory is accessible directly using application URL with certain modification to it. (for example, mywebsite.com/pages/en_US/Administration/ChangeMyPasswordForm.page.xml?637233407013218715) I can see almost all pages are accessible even without authentication. Is this a standard behavior of Mendix apps? If yes, Is there a way to restrict this access without authentication? If No, please suggest how to mitigate this vulnerability. Any document on this will be much helpful! Thanks!

asked 2020-11-03

Soumya Ranjan Bindhani

1 answers

Johan Flikweert - old account · Answer 1 · 2020-11-04

Hi Soumya,

Indeed, the structure of all Mendix pages can be retrieved from xml-files like you describe and those can be retrieved without authentication. Mendix does not consider this as a vulnerability, as only the structure of a page and the static text on a page is exposed, not any content. All sensitive data is probably stored within entities in the database, and not shown as static text on any page. To retrieve that sensitive data, you need to have an authenticated session to retrieve that via XPath or via a microflow / nanoflow.

In the same category, I asked Mendix to comment on the following:

Finding: Application metadata exposed
We found that the URL /metamodel.json exposes a lot of application internals, which can be used to stage an attack. It would be better to hide this file to not give a motivated attacker any clues.

Response of Mendix support:
We are aware the metamodel.json file is accessible publicly in Mendix 7. However you still need a valid session to use any of the information obtained. This means that any information you get from the metamodel.json is still restricted by the security model as defined in the Business Modeler. E.g. entities are still only accessible by those users that have a valid session with a user role that is defined (in the Business Modeler) to have entity access to the entity. The same applies to access rights for microflows, pages, and so forth.
So while the metamodel.json access is unrestricted, access to the application itself is not, as such, after extensive discussion within Mendix with our R&D and Security departments, we currently classify this as a "Medium" risk issue. It is on our product roadmap to implement this in a more secure way in Mendix 8. Unfortunately this also means that in Mendix 7 the current implementation will remain in place.

Hopefully, this helps the discussion!

Kind regards,

Johan