RPA Platform: Penetration Test Uncovers Critical Vulnerabilities in Multi-Tenancy Environment

A leading company in Robotic Process Automation commissioned us for the second comprehensive penetration test of their cloud platform. The first test was about a year ago - time for significant developments and new features.

Objectives & Scope

The RPA platform enables companies to automate complex business processes via a central web interface. As a multi-tenant system with different tenants, security of data separation was the main focus.

• Black-Box Test: No source code access, realistic attacker perspective
• Multi-Tenancy Focus: Prevent access to foreign tenant data
• API Security: REST endpoints and public API functions
• Authorization: Role-based access control across 12 test users

Result

Compared to the first test, the system was significantly more difficult to attack - a clear sign of successful security improvements. Nevertheless, new features and extended functionality introduced additional vulnerabilities that were quickly fixed.

The cloud-based RPA platform automates business processes for companies worldwide. As a SaaS solution with multi-tenancy architecture, security and data separation are business-critical.

Technical Stack & Architecture

• Backend: .NET-based REST API with various endpoints
• Frontend: Angular Single-Page-Application
• Authentication: Token-based (Bearer Authentication)
• Multi-Tenancy: Shared database with logical tenant separation

Special Challenges

The platform is not a complete multi-tenancy system with isolated environments per tenant. This shared architecture increases the risk of data leaks between tenants and requires particularly robust authorization checks.

With 64 hours of testing time and two experienced penetration testers, a comprehensive black-box test was performed from an external attacker's perspective.

Focus Area

Main focus was on multi-tenancy security: Can a user from tenant A access data from tenant B? Additionally, classic OWASP Top 10 vulnerabilities were tested.

We documented 13 actionable vulnerabilities in total. Compared to the first test, the total number decreased significantly, but new features also introduced new critical vulnerabilities.

The most sensitive vulnerabilities concerned data access and tenant separation - core risks for multi-tenant SaaS platforms.

The penetration test provided clear recommendations and prevented potential security incidents in the production environment of a business-critical SaaS platform.

Direct Value

• Validation of Security Improvements: Confirmation that measures from the first test were successfully implemented
• Risk Minimization Before Critical Features: New features could be rolled out securely
• Prioritized Roadmap: Clear classification of all findings for efficient remediation
• Continuous Improvement: Insights flowed into development processes

Prevented Risks

Without the test, the following scenarios would have been possible:

The second penetration test confirmed that continuous security testing is essential for rapidly growing SaaS platforms - especially for multi-tenancy architectures.

Recommendations for the Roadmap

• Centralized Authorization: Unified auth checks across all API endpoints instead of scattered implementations
• Input Validation as Standard: Whitelist-based validation for all user inputs, especially for file operations
• Regular Pentests: For multi-tenant systems without complete isolation, quarterly tests should be standard
• Security Awareness in Dev Team: Code reviews with security focus and training on OWASP Top 10 and API security
• Monitoring & Detection: Anomaly detection for suspicious API access across tenant boundaries