Dubai
Government-Backed Business Organization
A multi-application VAPT engagement for a government-backed Dubai business organization, focused on validating the security of its public-facing platforms and providing independently verified documentation for the companies and clients it supports.
Dubai
Government-Backed Business Organization
Trade Services
Business & Economic Growth
3 Web Applications
Multi-Platform Assessment
Third-Party VAPT
Client Assurance
As a government-backed organization, the client needed testing that could withstand external scrutiny. The assessment had to provide credible evidence that could be shared with businesses relying on its platforms.
Qualysec's experience securing platforms across different sectors and markets gave the organization confidence in the assessment.
The client required documentation clear and credible enough to stand on its own when shared externally.
All three web applications could be assessed through one engagement, simplifying coordination across multiple public-facing platforms.
The client wanted every implemented fix verified before the Letter of Attestation was issued.
The engagement combined VAPT, remediation guidance, retesting, and formal documentation so the organization could provide its clients with independent evidence of security testing.
Peer-verified
Trusted worldwide
Found in the second web application, one of the platforms generates PDF documents as part of its output, and a malicious script could be embedded into one of these files. When opened, the script would execute in the viewer's browser, giving an attacker a route into a user's session through a document that looks like routine platform output.
Potential impact: Session hijacking or unauthorized code execution in viewer's browser.
Certain administrative functions across the platforms could be reached without the application properly verifying the requesting user's privilege level, giving a standard user a path to functionality meant to be restricted to administrators.
Potential impact: Unauthorized execution of restricted administrative functions and system compromise.
Found in the third web application, this application wasn't consistently serving traffic over HTTPS, leaving data exchanged between visitors and the site open to interception on unsecured networks.
Potential impact: Interception of sensitive data transmitted over unsecured networks.
Certain endpoints allowed a user to access records belonging to another account or organization simply by changing an identifier in the request, without a server-side check confirming ownership.
Potential impact: Unauthorized access to confidential records of other accounts.
Several functions could be accessed without any authentication check at all, meaning an attacker didn't need valid credentials to reach them.
Potential impact: Unauthenticated access to restricted functionalities and sensitive data.
Unaddressed gaps across access control, authentication, and transport security could have created opportunities for unauthorized access to business and trade information and weakened the credibility of the security attestation intended for the organization's clients.
Qualysec remained involved beyond the initial assessment, working with the client's development team through remediation and retesting before preparing the documentation required for external assurance.
The team traced the underlying causes behind the key access-control and application security concerns.
Qualysec worked directly with the development team to strengthen content handling, privilege checks, HTTPS enforcement, ownership validation, and authentication controls.
Once remediation was verified, the assessment records were prepared to support the Letter of Attestation.
All three web applications were retested to verify the implemented changes and confirm that no additional issues had surfaced.
External Security Evidence
The organization received independently verified documentation for client assurance.
Three Platforms Reviewed
Its public-facing web applications were assessed through one coordinated engagement.
Remediation Verified
Implemented security changes were checked before the engagement was closed.
Letter of Attestation Issued
The organization received documentation it could share directly with the businesses and clients relying on its platforms.
If you need a penetration test, let’s have a talk. Fill out this form and we will ensure you are secured and hit full compliance without any hurdles. The immediate impact you can expect:
Our sales team will reach out instantly
We skip the back-and-forth to meet your deadline perfectly
We get your testing scheduled immediately without any delay
Total No. Of Vulnerabilities
Years in Business
Assessment Completed
Trusted Clients
Countries Served