GX Technology : Salesforce -> DisneyID SOAP Proxy Security Review Initial Checklist

Created by Katie Ross on Dec 30, 2019

Introduction

Before we begin the process of reviewing an application or component, we will need the following items to be provided to the Security Team

Initial Checklist

NameSalesforce SOAP proxy
OwnerUnknown User (neumj008)
DevelopersUnknown User (rusha011); Darryl Dekok; Unknown User (jonac003)
Jirahttps://jira.wdig.com/browse/DIWCPCT
DocumentationService takes a SOAP request from the salesforce servers with the fields: username, password and ip.  Only the password field is read (I believe static values will be used for the other fields), which is really an AuthZ session token.  Using the token, a request to the DisneyID service is made and only the "loginAuthorized" value of the response is checked.  Based on this the SOAP response is generated with either a "true" or "false" value.
Source Codehttps://github.wdig.com/GXTools/salesforce-soap-proxy
Running Environments

As a SOAP endpoint hit:

http://n7vgi1gxtlstca01.general.disney.private:8080/SalesforceSoapProxy/services/SforceAuthenticationService/

Environment Summary and AID

Salesforce SOAP to REST Proxy.pdf

Operational Summary
  • Deployment Process
    • Create a release of project in Jenkins
    • Jenkins pushes .war to servers via SCP
    • Jenkins deploys and configures application via SSH
  • Monitoring
    • Basic OS monitoring only
  • Logging
    • Rolling file logs based on size using logback

    • Logs copied to Splunk under index=dnpc_diguestexp

Threat Model

Salesforce SOAP Proxy Threat Model.tm4
Salesforce SOAP Proxy Threat Model.htm

Sample SOAP Call
SOAP Request
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:authentication.soap.sforce.com">
   <soapenv:Header/>
   <soapenv:Body>
      <urn:Authenticate>
         <urn:username></urn:username> <!-- ignored -->
         <urn:password>M0ZuHf3BB5lvmgWCtEy8sQ</urn:password> <!-- Guest's AuthZ Token -->
         <urn:sourceIp></urn:sourceIp> <!-- ignored -->
         <!--You may enter ANY elements at this point-->
      </urn:Authenticate>
   </soapenv:Body>
</soapenv:Envelope>
SOAP Response
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
   <soapenv:Body>
      <ns1:AuthenticateResult xmlns:ns1="urn:authentication.soap.sforce.com">
         <ns1:Authenticated>false</ns1:Authenticated> <!-- true or false depending on AuthZ token validity -->
      </ns1:AuthenticateResult>
   </soapenv:Body>
</soapenv:Envelope>

 

 

Attachments:

Salesforce SOAP Proxy Threat Model.htm (text/html)
Salesforce SOAP Proxy Threat Model.tm4 (tmt4/tm4)
Salesforce SOAP to REST Proxy.png (image/png)
Salesforce SOAP to REST Proxy.pdf (application/pdf)
soap_proxy.mht (message/rfc822)
soap_proxy.tms (application/octet-stream)
soap proxy.pdf (application/pdf)