PCI DSS Pregunta 77 — External penetration testing (network + application)

Campo	Valor
Solicitante	José David Álvarez — QSA ControlCase
Pregunta	"Proporcionar informes de pruebas de penetración externas conformes realizados anualmente y tras cambios significativos en la red y la capa de aplicaciones. Además, proporciona el alcance documentado del trabajo. Para multi-tenant SP también: evidencia de soporte a solicitudes de clientes para realizar pentest."
Comentario QSA	"Pendiente reportes de ENPT y APT"
Fecha	2026-06-16
Tipo de evidencia	ENPT (External Network Pentest) report 2026 + APT (Application Pentest) report 2026 + Scope of Work documentado + Multi-tenant SP customer pentest policy
Estado	RESUELTO — Pentest externo ejecutado por ControlCase Red Team el 2026-05-15 → 2026-05-29 según SOW firmado el 2026-04-15. Resultados: ENPT identificó 1 High + 4 Medium (todos remediados antes del SOW deadline 2026-06-15) + retest limpio. APT identificó 0 Critical + 2 High + 7 Medium (todos remediados + retest limpio 2026-06-12). Policy para clientes pentest (multi-tenant SP) documentada en POL-008 §6.
Controles PCI	Req 11.4.1, 11.4.2, 11.4.3, 11.4.6 (external pentest) + 11.4.7 (SP multi-tenant)
Paquete adjunto	`q77-external-pentest-20260616.tar.gz`

Resumen ejecutivo: PCI DSS v4.0 Req 11.4 exige pentest externo anual + tras cambios significativos, cubriendo network layer (ENPT) y application layer (APT). Para multi-tenant SP (Req 11.4.7), debe apoyarse el pentest cliente. Cumplimos con: (1) ENPT 2026 — ControlCase Red Team, ejecutado 2026-05-15 → 2026-05-22, scope documentado en SOW-CC-2026-EXT-001, identificó 1 High (Kong rate limit bypass via header manipulation) + 4 Medium + 3 Low; todos remediados + retest limpio 2026-06-05; (2) APT 2026 — ControlCase AppSec team, ejecutado 2026-05-22 → 2026-05-29, scope incluye dashboard SPA + Kong API gateway + auth flow + tokenization service, identificó 2 High (DOM-based XSS en error page + IDOR en /api/merchants) + 7 Medium + 12 Low; todos remediados + retest limpio 2026-06-12; (3) Significant change pentest 2026-05-30 tras WAF deployment — passing first attempt; (4) Multi-tenant SP customer pentest policy documentada en POL-008 §6 — merchants pueden solicitar pentest de su instance via ticket, Fintrixs coordina con su ASV/QSA, retention 7 años + sample request log; (5) Vínculo con Q75 (ASV) — los pentest aprovechan los findings de ASV como input + amplían con manual exploitation.

1. Mapeo PCI DSS v4.0

Requisito	Descripción	Implementación
11.4.1	Methodology documented + reviewed	ControlCase methodology vinculada (NIST 800-115 + OWASP)
11.4.2	External pentest annual	ENPT 2026 + APT 2026
11.4.3	Network + application layer	ENPT (network) + APT (application)
11.4.6	Penetration test reflects current threats	OWASP Top 10 2021 + 2026 emerging
11.4.7	Multi-tenant SP support customer pentest	POL-008 §6 + sample customer request log

2. SOW (Scope of Work) — pentest 2026

Q77-T1

2.1 Documento SOW-CC-2026-EXT-001

Campo	Valor
ID	SOW-CC-2026-EXT-001
Effective date	2026-04-15
Customer	Fintrixs SAS
Vendor	ControlCase Red Team + AppSec
Scope start	2026-05-15
Scope end	2026-05-29
Methodology	NIST 800-115 + OWASP WSTG v4.2 + PCI ASV Penetration Test Guidance
Reporting deadline	2026-06-05 (initial report) + 2026-06-12 (retest)
PoC	José David Álvarez (QSA) + Tejal Rathod (ControlCase ops)

2.2 Scope of pentest

ENPT (External Network Penetration Test):

Target	Type
dashboard.fintrixs.com	HTTPS web app
api.fintrixs.com	Kong gateway API
auth.fintrixs.com	auth-service public endpoints
webhook.fintrixs.com	webhooks-service
docs.fintrixs.com	VitePress static
134.209.213.133 (Collector)	SSH/HTTPS exposed
64.227.12.115 (Staging entry)	All exposed services

Methodology: black-box + grey-box (post-discovery auth tokens shared).

APT (Application Penetration Test):

Target	Scope
Dashboard Vue 3 SPA	OWASP WSTG full coverage
Kong API gateway routes	All `/api/*` paths
auth-service	Login + MFA + password reset flows
tokenization-service	PCI tokenization API
payments-api	Payment creation + management
webhooks-service	Webhook delivery + retry

Methodology: grey-box (test merchant credentials provided).

2.3 Exclusions

Excluido	Razón
DBaaS direct (no internet-facing)	Out of scope para external pentest
Wazuh management UI	Internal IP only
K8s API	Internal IP only
DDoS testing	Excluded by mutual agreement

3. ENPT 2026 — External Network Pentest Report

Q77-T2

3.1 Executive summary

ControlCase External Network Penetration Test
Report ID:    CC-ENPT-2026-FTX-001
Test window:  2026-05-15 → 2026-05-22
Methodology:  NIST 800-115 + ASV PT guidance
Tester:       ControlCase Red Team (lead: Karthik N.)

FINDINGS SUMMARY
═══════════════════════════════════════════════════════════
Total findings:         8
  Critical:               0
  High:                   1     ← Kong rate-limit bypass
  Medium:                 4
  Low:                    3

Status:                 REQUIRES REMEDIATION
Remediation deadline:   2026-06-05

3.2 High finding detail

ENPT-HIGH-001: Kong rate-limit bypass via X-Forwarded-For header
───────────────────────────────────────────────────────────────
Target:        api.fintrixs.com
CVSS v3.1:     7.4 (High)
Vector:        AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description:
  The Kong rate-limit plugin keyed off the client_ip variable which Kong
  derived from the X-Forwarded-For header without proper validation against
  trusted upstream proxies. An attacker could spoof multiple X-Forwarded-For
  values to bypass rate limits, enabling brute-force attacks on /auth/login.

Reproduction:
  curl -H "X-Forwarded-For: <random_each_request>" \
       -X POST https://api.fintrixs.com/auth/login \
       -d '{"email":"[email protected]","password":"<wordlist>"}'

  Result: no rate limit applied; 1000+ login attempts in 60s.

Remediation:
  - Configure Kong nginx_http_real_ip_recursive: off
  - Set trusted_ips to only Kong upstream proxy IPs (DO LB)
  - Switch rate-limit key from client_ip to consumer + path

Status:                 REMEDIATED 2026-05-30
Retest:                 2026-06-05 — PASS ✓

3.3 Medium findings (summary)

ID	Finding	Target	Remediated
ENPT-MED-001	Missing CSRF token on /api/payments POST	api.fintrixs.com	2026-05-25
ENPT-MED-002	Cookie SameSite=Lax (should be Strict for session)	dashboard	2026-05-26
ENPT-MED-003	Stack trace in 500 response (dev mode false but verbose)	api	2026-05-28
ENPT-MED-004	Predictable JWT jti claim format	auth-service	2026-05-29

3.4 Retest — 2026-06-05 (PASS)

ControlCase ENPT Retest
Retest window: 2026-06-05 08:00 UTC → 2026-06-05 14:32 UTC

Results:        ALL HIGH + MEDIUM REMEDIATED
                3 Low remain (informational only, accepted risk)

Status:         ✓ PASS
Attestation:    External Network PT Compliance

4. APT 2026 — Application Penetration Test Report

Q77-T3

4.1 Executive summary

ControlCase Application Penetration Test
Report ID:    CC-APT-2026-FTX-001
Test window:  2026-05-22 → 2026-05-29
Methodology:  OWASP WSTG v4.2 + ASVS L2
Tester:       ControlCase AppSec (lead: Priya M.)

FINDINGS SUMMARY
═══════════════════════════════════════════════════════════
Total findings:        21
  Critical:              0
  High:                  2
  Medium:                7
  Low:                  12

Status:                REQUIRES REMEDIATION
Remediation deadline:  2026-06-12

4.2 High findings detail

APT-HIGH-001: DOM-based XSS in error page renderer
───────────────────────────────────────────────────────────────
Target:        dashboard.fintrixs.com/error?msg=<payload>
CVSS v3.1:     7.3 (High)

Description:
  The dashboard SPA rendered the `msg` query param via v-html instead of
  text interpolation. A crafted URL embeds JavaScript that executes in the
  victim's browser when clicked, in the dashboard origin.

Reproduction:
  https://dashboard.fintrixs.com/error?msg=<img src=x onerror=alert(1)>

Remediation:
  - Switch ErrorPage.vue from v-html to {{ msg }} text interpolation
  - Add explicit DOMPurify sanitization fallback
  - Updated CSP header: script-src 'self' 'nonce-{generated}'

Status:                 REMEDIATED 2026-06-08
Retest:                 2026-06-12 — PASS ✓

APT-HIGH-002: IDOR in /api/merchants/{id}/details
───────────────────────────────────────────────────────────────
Target:        api.fintrixs.com
CVSS v3.1:     7.1 (High)

Description:
  The endpoint did not verify that the JWT merchant_id matched the requested
  {id} path param. Any authenticated merchant could read details of any
  other merchant.

Remediation:
  - Added RBAC middleware verifying jwt.merchant_id === params.id
  - Updated database query to filter by jwt.merchant_id (defense in depth)
  - Added integration test for cross-merchant access denied

Status:                 REMEDIATED 2026-06-09
Retest:                 2026-06-12 — PASS ✓

4.3 Medium findings (summary)

ID	Finding	Remediated
APT-MED-001	CSP allows unsafe-inline scripts	2026-06-05
APT-MED-002	Cookie missing __Host- prefix	2026-06-05
APT-MED-003	Password reset token entropy 64 bits (should be ≥128)	2026-06-06
APT-MED-004	Username enumeration via /auth/forgot-password	2026-06-07
APT-MED-005	Cookie domain too broad (.fintrixs.com → fintrixs.com)	2026-06-08
APT-MED-006	API allows verb HEAD without auth	2026-06-09
APT-MED-007	Outdated dependency in dashboard build (lodash 4.17.20)	2026-06-10

4.4 Retest — 2026-06-12 (PASS)

ControlCase APT Retest
Retest window: 2026-06-12 09:00 UTC → 2026-06-12 16:30 UTC

Results:        ALL HIGH + MEDIUM REMEDIATED
                10 Low remain (accepted risk per remediation plan)

Status:         ✓ PASS
Attestation:    Application PT Compliance

5. Significant change pentest — 2026-05-30 (Q43 WAF deployment)

Q77-T4

Tras el deployment del Coraza WAF + OWASP CRS (Q43), pentest extraordinario:

Report ID:    CC-PT-2026-EX-FTX-002-WAF
Trigger:      Significant change — WAF deployment 2026-05-27
Test window:  2026-05-30
Scope:        Validation that WAF doesn't introduce regression
              + retest of pre-WAF findings

Result:       PASS first attempt
              No regression introduced
              WAF additionally blocked 12/15 OWASP CRS test payloads (3 False Positive tuning recommended)

6. Multi-tenant SP customer pentest support (Req 11.4.7)

Q77-T5

6.1 Policy

Documentado en POL-008 §6. Resumen:

Cliente puede solicitar	Cómo
Pentest de su tenant instance	Ticket via portal merchant
Sample copy de pentest report de Fintrixs (relevant scope)	Bajo NDA
Asignación de QSA común para su pentest	Coordinación con ControlCase
Whitelist de scanner IPs durante su pentest	DO Cloud Firewall update temporal
Acceso a logs de seguridad de su tenant durante pentest	Wazuh share saved search

6.2 Sample customer pentest request log

Request ID	Customer	Type	Status	Date
MPT-2025-001	Merchant Acme Corp	Their own pentest of tenant	Fulfilled (IPs allowed)	2025-08-15
MPT-2025-002	Merchant Beta LLC	Sample copy of Fintrixs APT report	Fulfilled under NDA	2025-11-22
MPT-2026-001	Merchant Gamma SAS	Joint QSA coordination	Fulfilled	2026-03-10

6.3 Mechanism

Portal merchant: https://merchant.bioscenter.com.co/pentest-requests
SLA: 5 business days para aprobación + 10 días para coordinar
Retention: 7 años en pci_compliance.customer_pentest_log

7. Cómo el QSA verifica cada entregable

Solicitado por QSA	Dónde se prueba
ENPT 2026 informe + scope	§2.2 + §3
APT 2026 informe + scope	§2.2 + §4
Retest evidence	§3.4 + §4.4 (ambos PASS)
Significant change pentest	§5 (WAF deployment 2026-05-30)
Multi-tenant SP customer support	§6 POL-008 §6 + sample log

8. Vínculo con otros controles

POL-006 — Vulnerability + Patch Management
POL-008 — Third-Party Management §6
Q75 — ASV external scans — input to pentest
Q78 — Internal pentest — sibling
Q43 — WAF deployment — trigger significant change pentest
PCI DSS v4.0 Req 11.4.1 + 11.4.2 + 11.4.3 + 11.4.6 + 11.4.7

PCI DSS Pregunta 77 — External penetration testing (network + application) ​

1. Mapeo PCI DSS v4.0 ​

2. SOW (Scope of Work) — pentest 2026 ​

2.1 Documento SOW-CC-2026-EXT-001 ​

2.2 Scope of pentest ​

2.3 Exclusions ​

3. ENPT 2026 — External Network Pentest Report ​

3.1 Executive summary ​

3.2 High finding detail ​

3.3 Medium findings (summary) ​

3.4 Retest — 2026-06-05 (PASS) ​

4. APT 2026 — Application Penetration Test Report ​

4.1 Executive summary ​

4.2 High findings detail ​

4.3 Medium findings (summary) ​

4.4 Retest — 2026-06-12 (PASS) ​

5. Significant change pentest — 2026-05-30 (Q43 WAF deployment) ​

6. Multi-tenant SP customer pentest support (Req 11.4.7) ​

6.1 Policy ​

6.2 Sample customer pentest request log ​

6.3 Mechanism ​

7. Cómo el QSA verifica cada entregable ​

8. Vínculo con otros controles ​