Vulnerability Fixation
Multi Tenancy Vulnerability

What is Muti-tenancy?

Multi-tenancy is commonly used in Software as a Service (SaaS) applications, where a provider hosts a single instance of the application and serves multiple customers over the internet.

It offers benefits such as scalability, cost-effectiveness, and simplified maintenance, making it an attractive option for businesses looking to deliver cloud-based services to a broad audience.

Why Test for This Vulnerability?

  • Multi-tenancy testing ensures data isolation between different organizations using the same SaaS application.
  • If isolation fails, one tenant could view or modify another’s data, leading to major privacy and security breaches.
How We Test It?

Key checks include:

  • Tenant1 logging in with Tenant2’s URL.
  • Tenant1 accessing Tenant2’s data.
  • Tenant1 changing tenantId to impersonate Tenant2.
Fix and Testing Requirements

First, the application must be tested for multi-tenancy flaws.
For testing, we require:

  • Application (UAT) URL.
  • Tenant1 & Tenant2 URLs (if applicable).
  • Credentials for both tenants and their user roles.

Also Read :