Multi-tenant SaaS workforce management

Finding an MFA bypass in a multi-tenant SaaS platform

A six-day white box assessment of a multi-tenant workforce management platform, tested from both authenticated and unauthenticated perspectives across staging and production, combining manual application testing, API testing, business-logic analysis and source-code review.

White box web application penetration test, six days

The finding that set the grade

What we found

High

Temporary pre-MFA token accepted as a full credential

Classification: CWE-863 Incorrect Authorization

Impact

An attacker holding a user's password could present the short-lived token issued before the second factor, and have it accepted as a fully authenticated session. That allowed replacing the victim's registered authenticator, invalidating the original device, and holding persistent access to the account. The control intended to contain password compromise did not contain it.

Remediation

Separate temporary MFA tokens from access tokens by type, reject temporary tokens at every endpoint that is not the MFA challenge itself, and require a fully authenticated session with re-authentication before any authenticator change.

Findings by severity

Critical 0
High 1
Moderate 2
Low 4
Very Low 0

7 findings total

Overall risk grade

A Very Low No direct security risk. Minor deviations from best practice only.
B Low Minor issues, unlikely to be exploited or low impact if they are.
C Moderate Not an immediate threat, but exploitable under certain conditions.
D High Significant risk, with a moderate to high likelihood of exploitation.
F Critical Immediate severe threat, with a high likelihood of exploitation.

Equally important

What we did not find

A report that only lists problems is not an honest picture. These were tested for and not demonstrated, and that is stated as plainly in the report as the findings are.

No path to remote code execution was found.
No SQL injection was found.
No cross-tenant or cross-user data access was demonstrated.
No unauthenticated compromise was demonstrated. The primary attack path required a valid password.

The most significant attack path still required possession of a valid password. Saying so is the difference between a report and a sales document.

Outcome

After remediation

All seven findings were remediated, and a focused retest of the authentication, session-management, authorization and time-entry workflows confirmed closure before additional tenants were onboarded to the platform.

Find out what an attacker would find first.

Book a scoping call See a sample report