Websea security record

The exchange implements IP-based rate limiting across many of its devices, our analysis found that the IP can be forged using the "X-Forwarded-For" header. This happens because a front-end proxy, seemingly an Amazon Web Services Web Application Firewall, is reading the client IP from "X-Forwarded-For", trusting it and passing it to the exchange's services. The Web Application Firewall should only read the IP from "X-Forwarded-For" if it is situated behind a web server or load balancer which strips this header from the client-side request and appends it after correctly identifying the user. Moreover, it was discovered that the Web Application Firewall tries to DNS resolve domains in order to obtain the source IP address. Only certain domains belonging to the exchange try to resolve the attacker-provided domain but the rate limiting bypass is available on all of the services.

The API key in the application can be considered highly sensitive information. Anyone with access to the API key can move funds from the account and manage assets. The application creates a web-view to a URL which has the secret token appended as a GET parameter. The client-side JavaScript code then reads the token from the parameter and appends it as an HTTP header in subsequent API requests. The application's `AndroidManifest.xml` also has the flag `android:usesCleartextTraffic="true"` which allows requests over HTTP, without SSL/TLS, which can expose the token to Man-in-the-Middle attacks (for example: when using a public Wi-Fi network).

HTTP headers are well known and their implementation can make your application more versatile and secure. Modern browsers support many HTTP headers that can improve web application security to protect against clickjacking, cross-site scripting, and other common attacks. The important ones are missing and should be added to the response headers. They are listed below. - `Content-Security-Policy`: Content Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets. - `Strict-Transport-Security` (HSTS): HTTP Strict Transport Security is an opt-in security enhancement that is specified by a web application through the use of a special response header. Once a supported browser receives this header, that browser will prevent any communications from being sent over HTTP to the specified domain and will instead send all communications over HTTPS. It also prevents HTTPS click-through prompts on browsers.

The file at `https://www.websea.com/analysis/index.html` contains a previously emitted API access token as well as internal IPs for one of the project's API endpoints. It also contains other comments and raw Vue.js code, allowing attackers to potentially exploit logic which should only be available server-side.

Android application stores sensitive information in plaintext on the files located in `/data/user/0/com.websea.exchange/shared_prefs`. These files include the user's access token, IP, User ID, Auth Token, etc.