Reflected XSS to Session Hijack: Securing a Certificate Authority Reseller's Customer Portal
Client: A certificate authority reseller and web hosting platform (name withheld under client confidentiality)
12
Validated findings, from critical to low severity
1 Critical, 3 High
Findings prioritized for immediate remediation
70.6%
Initial risk score recorded at assessment
The challenge
As a certificate authority reseller, this client's business depends on customers trusting its portal and on the integrity of its email-based domain-validation process. It engaged Eiferone for a full external assessment of its customer portal, transport security, and supporting infrastructure.
The approach
Testing covered application-layer testing, infrastructure enumeration, transport-security evaluation, business logic analysis, and configuration review, aligned to OWASP WSTG, CVSS v3.1, and CWE.
What we found
The critical finding was a certificate-parsing tool on the customer portal that reflected attacker-supplied input back into the page without safe encoding. Because the application's session cookies weren't marked HttpOnly, the same flaw let injected script read and exfiltrate an authenticated victim's session token, a direct path to full account takeover with no credentials required. Three high-severity findings followed: the domain's own email-authentication configuration was permissive enough that spoofed messages wouldn't reliably be rejected, a serious problem for a company whose service depends on trusting email for domain validation; a hidden order parameter let any standard customer apply a discount tier meant only for approved partners; and the password-reset flow changed a user's password immediately on request, emailed the new password in plain text, and never invalidated the user's existing sessions, meaning a reset didn't actually remove access for anyone who already had it. Medium and low findings covered deprecated transport security on the mail service, a database error message that leaked backend technology details, a contact form that could be automated past its CAPTCHA, a password-recovery flow that let an attacker confirm which usernames existed on the platform, and baseline gaps in certificate-authority DNS authorization, DNSSEC, cipher suite configuration, and an expired certificate on a secondary domain.
The outcome
Eiferone's roadmap put the session-hijack path, the email-authentication gap, and the pricing bypass into the immediate zero-to-seven-day tier, alongside rebuilding the password-reset flow around single-use tokens and explicit session invalidation. Short-term and strategic tiers addressed the remaining medium and low findings.