Hidden Risks in the External Perimeter: Countermeasures Against Easily Overlooked Vulnerabilities
In the security world, there is a lot of talk about the need to monitor vulnerabilities that can compromise corporate assets. But what if we told you it's not just about scanning and risk monitoring? While such measures can certainly increase your security, it is important to focus on the source of the problem itself.
In this article, we will focus on vulnerabilities in the external perimeter. We will look at a group of vulnerabilities that often escape attention and explore how to better focus on identifying and eliminating them.
Marek is an ethical hacker with a strong sense of detail. During his career, he has exposed vulnerabilities in several well-respected software products and systems used by companies around the world. At axelum, his main role is identifying security vulnerabilities in complex systems, making him a key member of the Red Team.
Marek holds the world-renowned Offensive Security Certified Professional (OSCP) certification for ethical hacking. Among other things, Marek also developed the Perimeter Guard service, which actively protects the perimeter of our clients.
What is the External Perimeter?
The external perimeter includes everything an organisation is exposed to on the Internet – e.g. infrastructure, cloud solutions or third-party services. It may be FTP servers in the operation of their own ASN block, an API hosted on Azure, or analytical tools from third parties. All these services have a common goal - to process, store or make available your organisation's data, both for internal and external use. Thus, they create a virtual gateway that can be an unexpected path for various security threats and attacks.
Vulnerabilities that Escape
What are the most common vulnerabilities we may encounter? You might think that it doesn't apply to you. After all, you regularly perform penetration tests and scans, investing considerable resources in security. However, despite all security measures, surprising weaknesses can appear on the external perimeter.
One common security weakness is the use of debugging service interfaces in web applications and APIs such as Springboot Actuator or Jolokia. These tools provide information about how an application performs, such as its state, metrics, logs, configuration environment, and more. However, this also exposes sensitive data such as session cookies, tokens, or even usernames and passwords. This vulnerability often manifests itself when the tools mentioned above are thoughtlessly added to an application without properly considering their role and exposure within the outer perimeter.
Test environment and outdated applications
Another common source of unwanted vulnerabilities is test environments and applications no longer actively used. These resources may be forgotten or ignored after they have been used to test new features. With gradual development and changes in the environment, maintaining these resources can be difficult, and this leads to the occurrence of fundamental vulnerabilities.
A reverse proxy acts as an intermediary between the Internet and your application - it ensures a higher level of security and handles potential malicious attacks. In addition, reverse proxies can also be used for load balancing, caching or data transformation. However, misconfiguration can lead to a Server-Side Request Forgery (SSRF) vulnerability, where an attacker uses a reverse proxy to gain access to an organization's internal services, such as databases or web admin interfaces. As a result, reverse proxies become regular proxies. Unfortunately, this configuration error occurs quite often and may take a long time to detect.
Vulnerabilities that should be a thing of the past
Despite advanced technologies, including MVC frameworks and object-oriented interfaces for databases, we still encounter vulnerabilities that were common ten years ago and do not appear in new applications today. In particular, these are Cross-Site Scripting (XSS) and SQL Injection. But that doesn't necessarily mean developers can't learn. Rather, it is a situation where the application is still running on outdated technologies, and replacing it with a modern and robust solution is expensive or technically difficult.
Redundant services are not an example of a direct vulnerability, but running them on the outer perimeter of an organisation may increase the likelihood of attacks. We often encounter organisations that run services such as SSH, RDP, LDAP or Telnet on the outer perimeter. In this day and age of secure VPN technologies, there is no reason why such services should be run directly on the perimeter. While the protocol itself may be secure, the possibility of weak or default passwords must be kept in mind.
Dependence on various third-party service providers can significantly expand an organisation's external security perimeter. Unlike internal infrastructure, control mechanisms such as firewalls, access monitoring or applied access policy are often missing. If these services' providers do not take security seriously, an attacker can easily use their infrastructure to penetrate your organisation's network.
As an example, let’s mention a payment gateway that was provided to the client by a third party. The payment gateway contained Command Injection (running a system command on a remote server) and "unknowingly" allowed us access to the organisation's network during one of the simulated exercises. The organisation and the vendor were completely unaware of the vulnerability itself.
Possible Sources of Problems
Several factors may contribute to vulnerabilities being overlooked or inadequately addressed. But what are their causes?
Insufficient knowledge of the services and applications you use can be a big problem. When an organisation is not fully aware of all services on the external perimeter, some of them may be missed during penetration tests or security monitoring. This problem was particularly evident in 2021 when the Log4Shell vulnerability was discovered. Many organisations faced the challenge of identifying all their Internet systems and applications, which led to a situation where some of them remained vulnerable for a long time or were unexpectedly discovered only during security tests.
Before starting penetration tests, it is necessary to define the objectives of the testing and determine its scope. It is also important to ensure that the security team performing the tests has all relevant information about the system under test. The absence of clearly defined objectives and insufficient information provided to the team may lead to incomplete or ineffective testing. This means some vulnerabilities may not be identified or investigated with the necessary thoroughness during testing.
Vulnerabilities in third-party components
Today, most organisations rely on services provided by third parties. As we mentioned, these services may include specific vulnerabilities the organisation has no direct control over. Identifying and remediating these vulnerabilities can be complex, requiring close collaboration with providers and a thorough understanding of integration aspects.
Wrong risk assessment of vulnerabilities
Sometimes it happens that a vulnerability in the system is identified, but the risk associated with it is incorrectly evaluated. As a result, such a vulnerability may be considered less serious than it actually is, leading to insufficient or inadequate remediation.
And What are the Possible Solutions to Avoid these Problems?
Do you know your assets? An essential first step in external perimeter security is to have an overview of everything you operate. It often happens that organisations are not fully aware of the extent of web applications and services that are exposed to the Internet. However, as we have already shown, it is essential to have a detailed knowledge of all IP addresses, network ranges and domains that fall within your infrastructure.
Sometimes vulnerabilities may be discovered in components provided by third parties that are not directly under the control of the organisation. While an organisation cannot always remove these vulnerabilities directly, it is essential to be aware of them. Regular review of these external components (for example, using a third-party security audit) is key to preventing a wide range of security issues that could affect the organisation's external perimeter.
It is important to carefully consider whether you really need to access certain services or applications from the public network. Their deployment should be limited to internal environments if it is not necessary. Otherwise, the key is to set accesses as restrictive as possible and manage them with authorisation and authentication. It is also a good idea to regularly monitor the availability of these services, and if they are no longer needed, their access should be blocked.
Penetration tests are important, but they alone are not enough. Since vulnerabilities appear all the time, it is necessary to conduct testing on an ongoing basis. For this, both commercial and open-source tools and scanners can be used. Today, they can reveal the most basic vulnerabilities or configuration deficiencies.
Despite the available procedures for vulnerability assessment, the human factor is still key. Relying solely on ratings generated by automated tools or external entities is not appropriate. This may lead to incorrect priority setting. And the consequence is that some serious vulnerabilities are not identified and remedied in time or at all.
The key element is the human factor and open communication in the security team. This process includes not only self-reflection but also the creation of such conditions that minimise the negative effects of sharing this information.
Therefore, we recommend examining the external perimeter from different perspectives and not relying on just one method of preventing vulnerabilities. Having a tactical plan for their solution and subsequent removal is also important. Vulnerability information is one thing, but it can take weeks to get patched. Simple measures like Web Application Firewall (WAF) rules or general access restrictions can be of great help.
Track Risks that Threaten Your Assets
Are you ready to identify your organisation's external perimeter vulnerabilities? We have created a comprehensive Perimeter Guard service to respond to this issue. Our solution comprehensively scans online objects to identify areas to improve perimeter security. We currently supply it to organisations in the banking and retail sectors as well as large telecommunications companies. Perimeter Guard is suitable for virtually any organisation that has an Internet footprint. And who doesn't have one these days, right?
You Might Also Be Interested
Do you know the risks that may threaten your assets? Infrastructure, cloud solutions, third-party services and more. All of these form a virtual gateway that attackers can use to get into your business. Join us on March 21 at 10 AM for a webinar where security experts will reveal how an attacker could exploit your vulnerabilities, as well as give you tips on how to monitor and, most importantly, prevent these external perimeter threats.
Many people have a romanticised view from the films that an attacker is going to immediately pick the locks on a door in order to gain access in the depths of the night to steal sensitive information. Does it really work that way? Physical security is still one of the most overlooked and underfunded areas for major organisations.
Right in Your Inbox
Stay up to date and get the newsletter. Every month, you can look forward to exclusive educational content and news from the infosec world.
