We are a new to PowerApps. Our company would be using PowerApps at the enterprise level. However, during the proof of concept stage, an IT security audit was done. There are two(2) high level vulnerabilites found.
I have done extensive research and have been unable to find a resolution or something I could give to IT Security to address these issues.
Can anyone assist me on this or have a resolution for these:
1. Session token in URL
Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing session tokens into the URL increases the risk that they will be captured by an attacker.
Risk Level : Medium
Likelihood : Low
Risk: High
Findings
Security discovered the URL in the request appears to contain a session token within the query string.
Port/Protocol
443/TCP
Path
/autherror
/bundles
/sdkpreload
/webplayer/app
2. Insecure Java Deserialization
Serialization is a process used by Java to convert an object into raw binary for storage or transmission. In the latter case, the serialized object is then transmitted to a listening host, de-serialized, and then executed. If the listening host does not perform proper validation on the serialized data it receives, a malicious user can exploit this behavior to execute code on the vulnerable system.
Risk Level: High
Likelihood : Medium
Risk : High
Findings
Security inserted a time-based payload into the HTTP request that would trigger a time delay if it were unsecurely deserialized using the Jackson library/API. The base HTTP request took 2029ms to execute, whereas the request containing the payload took 83591ms, indicating that the application is deserializing arbitrary objects using the Jackson library/API and is vulnerable to arbitrary code execution
Path
/bundles/App
Parameter
PowerAppsSessionId=
Library
Jackson
Json.NET
Any assistance is greatly appreicated.
Thanks...
