ONFA - Pentesting

CertiK16 Nov 2024Code version: not recorded (see the report)

Penetration test of off-chain systemsNot counted as an audit report

CertiK reviewed ONFA (ONFA - Pentesting) on 16 Nov 2024: 11 findings, 0 critical; 4 marked fixed, 7 open.

No open critical findings

Open the report Open ONFA’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings11

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	0
Medium	3	0
Low	4	4

LowLack of Jailbreak/Root detectionFixed

The Onfa iOS application does not adequately detect if the device is jailbroken. As a result, the data which is stored via the applications can be exposed when the device is rooted.

LowSelf Cross-Site Scripting (XSS) in Activity LogsFixed

When a user performs actions such as login, logout, or removing an IP from the whitelist, the application logs the IP and User-Agent. These logs are displayed to the user in `Settings > Activity Logs`. By modifying the User-Agent to include an XSS payload, a user can execute JavaScript code within their own session.

LowUser Enumeration in LoginFixed

The `Login` functionality allows an attacker to infer if an email is registered on the platform based on the server response. When an invalid email is sent to the server, the server responds with `Email address does not exist.`. If the email is registered but the password is wrong, the server responds with `Wrong password.`

LowWeb server information disclosureFixed

The application exposes information about the software version used through the HTTP headers. - `X-Powered-By: ASP.NET` - `X-Aspnet-Version: 4.8.50727` - `X-Aspnetmvc-Version: 4.8`