Handouts URL discovery at University MongoDB
While taking the “M101JS: MongoDB for Node.js Developers” course I came across one potential security issue where students were able to download upcoming week's handouts before they were officially available for the general public on the platform - MongoDB University courses.| The issue was reported and acknowledged by the MongoDB security team whom gave me the proper recognition about the discovery listing my name on the security recognition page as a contributor. Recognition section at the bottom of the page: http://www.mongodb.com/security |
As part of this course, students are asked every week to download the course materials (handouts) consisting mostly on:
- Exercises performed by the instructor that helps the students to have hands on practise on the material covered during each video lecture.
- Materials prepared beforehand by the instructors (e,g: scripts, data sets, etc) for the final unit assignments.
As you can notice in the screenshot below, the handouts materials are not intended for the general public for download until the corresponding release date.
Figure 1: M101JS: MongoDB for Node.js Developers. Syllabus showing handouts that are not yet available.
However, the “Not Yet Available” units might not be as restricted as they are intended to be. After having spent some time analyzing the download URLS from prior weeks, I came across the pattern being used for the URLS generation. Looking more carefully at the links below you will come to realize that the URLs match the title of each week’s unit.
| UNIT TITLE | HANDOUTS URL |
Week 1 : Introduction
|
href=“/static/10gen_2014_M101JS_June/handouts/week_1_introduction.zip"
|
Week 2: CRUD
|
href=“/static/10gen_2014_M101JS_June/handouts/week_2_crud.zip"
|
Week 3: Schema Design
|
href="/static/10gen_2014_M101JS_June/handouts/week_3_schema_design.zip"
|
Week 4: Performance
|
href=“/static/10gen_2014_M101JS_June/handouts/week_4_performance.zip"
|
Week 5: Aggregation Framework
|
href=“/static/10gen_2014_M101JS_June/handouts/week_5_aggregation_framework.zip”
|
Week 6: Application Engineering
| |
Week 7: Mongoose
| |
Final Exam
|
Figure 3: Table with associations between the week’s title and their corresponding download link. Highlighted in red are the course materials that are “Not Yet Available” due to their release date.
Measures suggested
- Do not expose any resource with meaningful information (e,g: name, extension, etc) unless it is intended to be public and available for the general public.
- Generate universally unique identifier (UUID) links for each resource being exposed. This way it would be pretty much impossible to detect and predict any pattern used for the download url and thus not allowing users to download materials before the release date.
- Protect all the resources with access restriction not allowing access to the resource by any means unless it is the actual intention. This could be handled by setting up a connector or a filter that would check the availability of the resources (e,g: based upon user roles, release date, etc) before the request goes through.
Measures taken by the company
- MongoDB decided to proceed by first obfuscating the files so they are more difficult to be found.
- Next, MongoDB team will move these files elsewhere and implement proper authentication and authorization controls for these assets. This is the correct fix for this problem but takes more effort to implement so it will be phased in over time.
Affected Website (and other courses within the same platform): https://university.mongodb.com
Summary: “Not Yet Available” handouts can be easily downloaded predicting potential URLs end points.
Share story
0 comments: