Security review for login-service & survey-web-app -- App Engine, Python, Javascript

  • Status: Closed
  • Præmier: $1000
  • Modtagne indlæg: 5
  • Vinder: newsoftwaresolu

Konkurrence Instruktioner

GOAL
I have a prototype login-system, similar to open-ID, for authenticating voters. Also I have a survey web-app using the login-system.

This is a contest to find the most important security problem, both in the login site and in the survey app.

Describe the vulnerability, with:
* Endpoint affected
* Example exploit / input
* Estimate of severity / potential bad effects
* Suggested fix


SYSTEM
The system runs in Python on Google App Engine, with client webpages using Javascript.

The code is here:
https://github.com/chadbrower0/openVoterId3
https://github.com/chadbrower0/proCon3


EXAMPLE DATA
Survey web-app example pages:
* You may need to copy & paste these links, because freelancer.com breaks these URLs.
* Feel free to create more example pages.
* https://www.choosewithreason.com/procon#page=proposal&link=9DxVVGWcWlmPQLofuJ2vuCP1yAQ7gsOczmkbmB2TIXVlKOZij7
* https://www.choosewithreason.com/procon#page=request&link=ydef4LAXNkHnOOQoyDp8cvuFu3s4h6YnwRAy1ZGHqtmOkM5IWy
* https://www.choosewithreason.com/autocomplete#page=question&link=soGqnBjwQMm2koXVbV4KgaOMD5wv4FpdeX8PPIznHfc1oi9iuc
* https://www.choosewithreason.com/autocomplete#page=question&link=07CPZ6KFprXg9QSl5MEZXaQ1wgh6Az0oOY1kHymXyj5aavHsi2

Example voter information is attached separately.

Anbefalede færdigheder

Arbejdsgiverfeedback

“@newsoftwaresolu won the contest on 22 June 2020”

Profilbillede chadbrower, United States.

Bedste indlæg fra denne konkurrence

Se flere indlæg

Offentlig Præciserings Opslagstavle

  • newsoftwaresolu
    newsoftwaresolu
    • 3 år siden

    please find attached our proposition

    • 3 år siden
    1. chadbrower
      Konkurrenceafholder
      • 3 år siden

      Thanks! This is the first real security finding submitted so far.

      • 3 år siden
    2. newsoftwaresolu
      newsoftwaresolu
      • 3 år siden

      Thanks ! I'm very happy to work with you.

      • 3 år siden
  • mt7871
    mt7871
    • 3 år siden

    Not able to login using voter information provided.

    • 3 år siden
    1. chadbrower
      Konkurrenceafholder
      • 3 år siden

      You would have to crack in.

      The only login-verification currently allowed, is the "mailed code", which is not provided. (I should not have provided the fake phone/birthdate/email in the sample voters file, attached.)

      • 3 år siden
    2. chadbrower
      Konkurrenceafholder
      • 3 år siden

      I've replaced the fake-voter information attachment with a version that does not contain the unneeded phone/birthdate/email.

      • 3 år siden
  • chadbrower
    Konkurrenceafholder
    • 3 år siden

    The contest-system auto-selected file-types for graphics (GIF, JPEG), but I assume most entries will be PDF. It's also fine to submit graphics with description in the comments / chat section.

    • 3 år siden

Vis flere kommentarer

Sådan kommer du i gang med konkurrencer

  • Opret din konkurrence

    Opret din konkurrence Hurtigt og nemt

  • Få tonsvis af indlæg

    Få tonsvis af indlæg Fra hele verden

  • Tildel det bedste indlæg

    Tildel det bedste indlæg Download filerne - Nemt!

Opret en Konkurrence Nu eller slut dig til os i dag!