1. Web-based Document Management System By Group 3 Xinyi Dong Matthew Downs Joshua Ferguson Sriram Gopinath Sayan Kole

2.  Web-based interface  Documents stored, shared and accessed securely  Role-based Access Control  System log to track activity System Overview

3.  Client: Modern web browser (no IE6)  Web Server: Windows Server 2008, IIS 7  Database Server: SQL Server 2008 R2  Framework: ASP.NET  Language: C#  Architecture: MVC (model view controller) Operating Environment

4. MVC Image taken from http://www.asp.net/mvc/whatisaspmvchttp://www.asp.net/mvc/whatisaspmvc

5.  User Account Management  Xinyi Dong  Matthew Downs  Document Management  Joshua Ferguson  Sayan Kole  Auditing and Logging  Sriram Gopinath Task Assignment

6. Mostly Functional Bugs And Few Security Vulnerability Vulnerabilities Identified

7. User log in and register Valid  ?? Invalid  No password recovery feature implemented.  Administrator is able to view Username and User password.  Inappropriate error message given to the user- Input for username is inappropriate, but shows password doesn't match.  After registration, it logs me in directly without admin approval. User Management

8. Function and security vulnerability Valid  System log information, document download link, share doc page can be obtained by any user by using the back link of the browser after the admin has logged out.(browser dependent)  UserID is displayed on the screen. Invalid  Session remains valid when you copy the url link from one browser to another type of browser..  Sql injection takes place. No input validation.  Email not validated.  An attacker can purposely enter wrong passwords for the admin to lock the admin out of the site.  Username "null" reflected in page shows the lack of proper validation User Management

9. Account Management Valid  ?? Invalid  In the admin section, there is no approval/denial of Users functionality present.  There is not limit to what can be entered in the request box, could throw null or expand the website size  Able to be a manager/employee to multiple departments  It will make random users(??) User Management

10. Share and Update Documents with Users Valid  Incorrect access control policy, the employee can see Manager’s document without even sharing it.  Listing of shared documents incorrect.  Sharing documents among users in different department not working  The document is not able to be checked in after it was checked out.  Sharing by assigning privileges absent  Interface doesn’t show any difference between shared documents and current documents.  Updating document you can update original document with any other document. Invalid  NA Document Management

11. Upload/Download Documents, Encryption and Decryption Valid  If an user clicked download button more than twice even they fails to upload the documents, the error shows up Un- Encrypted Files Can’t be Read.  All files require keyword to decrypt key  If no file given then goes to blank page  While editing a file, when the encryption check box is checked and upload is pressed, an exception occurs which is not handled.  Delete file after checkout  When the decryption key provided by the user is very long, the system crashes. Document Management

12. Upload/Download Documents, Encryption and Decryption Invalid  Can upload same document multiple times  Upload not happening, just a blank screen is coming without any error message.  When the user tries to decrypt an encrypted file, the system does not check if the user provided the right encryption key.  Every uploaded file is displayed twice even though it is uploaded only once. Document Management

13. Valid  An user can check in/ check out any document with specific file ID without any permission.  Upload not happening, just a blank screen is coming without any error message. Document Access

14. Valid  Can get the document download link by the back button of browser (Browser dependent)  Expose document ID in URL Solution:  Proper Session Management  Using the Document id as a form value Security issues with documents

15. Function and security vulnerability Valid  Dates are wrong Invalid  Captcha produces letters which cannot be entered  Brute force protection is set up for password guessing, but it can backfire for the admin. An attacker can purposely enter wrong passwords for the admin to lock the admin out of the site. Others

16. Questions