Mathematik | Informatik
Samriddhi Singh, 2007 | meilen, ZH
The intranet platform intranet.tam.ch is used by 50,000 students and teachers across 44 Swiss high schools and vocational schools. It stores users‘ sensitive personal data, including names, email addresses, phone numbers, home cities, class memberships, and timetables. With written permission from the administrators, a penetration test was conducted on the staging environment stage.tam.ch using a single student account, the lowest possible access level. Four vulnerabilities were documented in tam.ch, two successfully exploited. A supplementary assessment of Balloon, a cloud storage platform used by the same schools, was also conducted during the correction phase, uncovering an additional eight vulnerabilities.
Introduction
How secure is the platform and the personal data it holds? What vulnerabilities exist, how easily can they be exploited with only a standard student account, and what real-world attack scenarios does this enable? The goal was to find weaknesses and understand how they chain together into realistic attacks.
Methods
The pentest followed a standard five-phase approach: scope definition, enumeration, vulnerability analysis, exploitation, and risk assessment. It was conducted as a grey-box test (the administrators provided partial information about the system ) inside a Kali Linux virtual machine. Key tools included Burp Suite Pro, nmap with vulscan, nikto, DirBuster, Metasploit, ngrok, and Wappalyzer. A custom Python script generated 7.1 million candidate usernames from Swiss Federal Statistical Office population data. The Balloon assessment was conducted over four days in March 2026 with valid credentials and full access to its publicly available source code on GitHub.
Results
Two intranet vulnerabilities were successfully exploited. The password reset page returned distinct error messages depending on whether a username existed, allowing unauthenticated account enumeration. Since usernames follow a first.last format, confirmed accounts directly expose real names and email addresses. Automating 7.1 million submissions confirmed 184 valid accounts at one school. This vulnerability remains unpatched. The second finding was a high-severity CORS misconfiguration: the server trusted any requesting origin and permitted credentialed cross-origin requests, enabling any website to silently read authenticated intranet data on behalf of a logged-in student. A proof-of-concept retrieved full contact records for an entire class. This was patched on intranet.tam.ch but not on all affected services. Additional weaknesses discovered but not exploited were a reflected XSS and a dependency on end-of-life jQuery versions with eight known CVEs. On Balloon, /api/v2/users returned the complete user directory to any authenticated user with no privilege check, exploitable in under 30 seconds. Further Balloon findings included XSS, deployment credentials exposed in a public GitHub repository, five absent security headers, and a hardcoded SSL passphrase in publicly visible source code.
Discussion
The two intranet findings form a complete, low-skill attack chain. An attacker with no account extracts student email addresses via the password reset flaw, sends them phishing emails linking to a malicious page, and any student who clicks while logged in silently exposes their classmates‘ full contact records. The attacker never contacts the intranet directly as all requests originate from the victim’s browser. During the correction phase, a recheck found the original CORS misconfiguration only partially fixed. A new variant on apistage.tam.ch and stage.tam.ch trusted any domain ending in tam.ch, bypassable since such domains can be freely registered. On Balloon, any authenticated user retrieves the full user directory with a single browser request. The density of findings on the balloon platform suggests a more exhaustive review would surface further issues.
Conclusions
Platforms handling personal data of minors carry a particular responsibility, and penetration testing provides an independent review of whether that responsibility is met in practice. Retesting during the correction phase uncovered an incomplete fix, demonstrating that a one-time audit is insufficient. Serious vulnerabilities were accessible to anyone with a student account or none at all. The fixes are straightforward: uniform password reset responses, strict CORS origin whitelisting, role-restricted API endpoints, and proper security headers. Regular assessments, timely patching, and secure defaults are essential for any system trusted with data at this scale.
Würdigung durch den Experten
Daniel Dulay
This work presents a security evaluation of an intranet and file-sharing platform used by 44 Swiss high schools and Berufsschulen. Through structured penetration testing of the web frontends, several vulnerabilities were identified and successfully exploited, potentially exposing users‘ private data. The findings underscore the importance of security testing to maintain secure platforms and to ensure the trustworthy handling of sensitive data. Retesting during the coaching phase revealed an incomplete fix for a vulnerability found in the first test and also a new leak of sensitive data.
Prädikat:
Silber
Sonderpreis «startup days» gestiftet vom Eidgenössischen Institut für Geistiges Eigentum
Kantonschule Uetikon am See
Lehrer: Raphael Barengo