ZAP Full Scan Report - Githubissues

GSiach13 / juice-shop-hms

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application - to be made secure

https://owasp-juice.shop

MIT License

0 stars 0 forks source link

ZAP Full Scan Report #7

Open github-actions[bot] opened 2 weeks ago

github-actions[bot] commented 2 weeks ago

Site: http://cdnjs.cloudflare.com New Alerts
- Vulnerable JS Library [10003] total: 1:
  - http://cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js
- Base64 Disclosure [10094] total: 5:
- Information Disclosure - Suspicious Comments [10027] total: 2:
  - http://cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js
  - http://cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js
- Retrieved from Cache [10050] total: 12:
Site: http://83.212.109.249:3001 New Alerts
- Cloud Metadata Potentially Exposed [90034] total: 1:
  - http://83.212.109.249:3001/latest/meta-data/?EIO=4&transport=polling&t=PCgTKuE&sid=iC7Qc9kHr-3FBuVYABTt
- SQL Injection - SQLite [40018] total: 1:
  - http://83.212.109.249:3001/rest/products/search?q=%27%28
- Backup File Disclosure [10095] total: 31:
  - http://83.212.109.249:3001/ftp/quarantine%20-%20Copy
  - http://83.212.109.249:3001/ftp/quarantine%20-%20Copy%20(2)
  - http://83.212.109.249:3001/ftp/quarantine%20-%20Copy%20(2)/juicy_malware_linux_amd_64.url
  - http://83.212.109.249:3001/ftp/quarantine%20-%20Copy%20(2)/juicy_malware_linux_arm_64.url
  - http://83.212.109.249:3001/ftp/quarantine%20-%20Copy%20(2)/juicy_malware_macos_64.url
  - ..
- Bypassing 403 [40038] total: 5:
  - http://83.212.109.249:3001/%2e/ftp/coupons_2013.md.bak
  - http://83.212.109.249:3001/%2e/ftp/eastere.gg
  - http://83.212.109.249:3001/%2e/ftp/encrypt.pyc
  - http://83.212.109.249:3001/%2e/ftp/package.json.bak
  - http://83.212.109.249:3001/%2e/ftp/suspicious_errors.yml
- CORS Misconfiguration [40040] total: 131:
  - http://83.212.109.249:3001
  - http://83.212.109.249:3001/
  - http://83.212.109.249:3001/api
  - http://83.212.109.249:3001/api/Challenges
  - http://83.212.109.249:3001/api/Challenges/?name=Score%20Board
  - ..
- Content Security Policy (CSP) Header Not Set [10038] total: 12:
  - http://83.212.109.249:3001/
  - http://83.212.109.249:3001/ftp
  - http://83.212.109.249:3001/ftp/coupons_2013.md.bak
  - http://83.212.109.249:3001/ftp/eastere.gg
  - http://83.212.109.249:3001/ftp/encrypt.pyc
  - ..
- Cross-Domain Misconfiguration [10098] total: 11:
  - http://83.212.109.249:3001/
  - http://83.212.109.249:3001/assets/public/favicon_js.ico
  - http://83.212.109.249:3001/ftp/eastere.gg
  - http://83.212.109.249:3001/ftp/encrypt.pyc
  - http://83.212.109.249:3001/main.js
  - ..
- Missing Anti-clickjacking Header [10020] total: 12:
  - http://83.212.109.249:3001/socket.io/?EIO=4&transport=polling&t=PCgT6bv&sid=Vwf5DCgsq_AKVwEZABSu
  - http://83.212.109.249:3001/socket.io/?EIO=4&transport=polling&t=PCgT7U4&sid=dPcEbVoVaxEMCv94ABSw
  - http://83.212.109.249:3001/socket.io/?EIO=4&transport=polling&t=PCgT8Qz&sid=RlukcNGF-53rY1htABSy
  - http://83.212.109.249:3001/socket.io/?EIO=4&transport=polling&t=PCgT9hW&sid=q_PpMZgG7xKV0ofQABS0
  - http://83.212.109.249:3001/socket.io/?EIO=4&transport=polling&t=PCgTBDP&sid=1jQsUPUKq-9BWMsrABS2
  - ..
- Session ID in URL Rewrite [3] total: 12:
  - http://83.212.109.249:3001/socket.io/?EIO=4&transport=polling&t=PCgT6bx&sid=Vwf5DCgsq_AKVwEZABSu
  - http://83.212.109.249:3001/socket.io/?EIO=4&transport=polling&t=PCgT7ad&sid=dPcEbVoVaxEMCv94ABSw
  - http://83.212.109.249:3001/socket.io/?EIO=4&transport=polling&t=PCgT7U5&sid=dPcEbVoVaxEMCv94ABSw
  - http://83.212.109.249:3001/socket.io/?EIO=4&transport=polling&t=PCgT8R0&sid=RlukcNGF-53rY1htABSy
  - http://83.212.109.249:3001/socket.io/?EIO=4&transport=polling&t=PCgT8V3&sid=RlukcNGF-53rY1htABSy
  - ..
- Web Cache Deception [40039] total: 5:
  - http://83.212.109.249:3001/assets
  - http://83.212.109.249:3001/assets/i18n
  - http://83.212.109.249:3001/assets/public
  - http://83.212.109.249:3001/assets/public/images
  - http://83.212.109.249:3001/assets/public/images/products
- Cross-Domain JavaScript Source File Inclusion [10017] total: 10:
  - http://83.212.109.249:3001/
  - http://83.212.109.249:3001/
  - http://83.212.109.249:3001/juice-shop/build/routes/fileServer.js:39:13
  - http://83.212.109.249:3001/juice-shop/build/routes/fileServer.js:39:13
  - http://83.212.109.249:3001/juice-shop/node_modules/express/lib/router/index.js:286:9
  - ..
- Dangerous JS Functions [10110] total: 2:
  - http://83.212.109.249:3001/main.js
  - http://83.212.109.249:3001/vendor.js
- Deprecated Feature Policy Header Set [10063] total: 11:
  - http://83.212.109.249:3001/
  - http://83.212.109.249:3001/ftp
  - http://83.212.109.249:3001/ftp/eastere.gg
  - http://83.212.109.249:3001/ftp/encrypt.pyc
  - http://83.212.109.249:3001/ftp/package.json.bak
  - ..
- Full Path Disclosure [110009] total: 5:
  - http://83.212.109.249:3001/ftp/coupons_2013.md.bak
  - http://83.212.109.249:3001/ftp/eastere.gg
  - http://83.212.109.249:3001/ftp/encrypt.pyc
  - http://83.212.109.249:3001/ftp/package.json.bak
  - http://83.212.109.249:3001/ftp/suspicious_errors.yml
- Private IP Disclosure [2] total: 1:
  - http://83.212.109.249:3001/rest/admin/application-configuration
- Timestamp Disclosure - Unix [10096] total: 3:
  - http://83.212.109.249:3001/main.js
  - http://83.212.109.249:3001/rest/admin/application-configuration
  - http://83.212.109.249:3001/rest/admin/application-configuration
- X-Content-Type-Options Header Missing [10021] total: 12:
  - http://83.212.109.249:3001/socket.io/?EIO=4&transport=polling&t=PCgT6bx&sid=Vwf5DCgsq_AKVwEZABSu
  - http://83.212.109.249:3001/socket.io/?EIO=4&transport=polling&t=PCgT6Xs
  - http://83.212.109.249:3001/socket.io/?EIO=4&transport=polling&t=PCgT7ad&sid=dPcEbVoVaxEMCv94ABSw
  - http://83.212.109.249:3001/socket.io/?EIO=4&transport=polling&t=PCgT7Qp
  - http://83.212.109.249:3001/socket.io/?EIO=4&transport=polling&t=PCgT7U5&sid=dPcEbVoVaxEMCv94ABSw
  - ..
- Base64 Disclosure [10094] total: 5:
  - http://83.212.109.249:3001/ftp
  - http://83.212.109.249:3001/ftp/
  - http://83.212.109.249:3001/ftp/quarantine
  - http://83.212.109.249:3001/main.js
  - http://83.212.109.249:3001/vendor.js
- CORS Header [40040] total: 3:
  - http://83.212.109.249:3001/socket.io/?EIO=4&transport=polling&t=PCgTK-j&sid=iC7Qc9kHr-3FBuVYABTt
  - http://83.212.109.249:3001/socket.io/?EIO=4&transport=polling&t=PCgTLLn
  - http://83.212.109.249:3001/socket.io/?EIO=4&transport=polling&t=PCgTKuE&sid=iC7Qc9kHr-3FBuVYABTt
- Cookie Slack Detector [90027] total: 21:
  - http://83.212.109.249:3001/assets/public/images/hackingInstructor.png
  - http://83.212.109.249:3001/assets/public/images/products
  - http://83.212.109.249:3001/assets/public/images/products/apple_juice.jpg
  - http://83.212.109.249:3001/assets/public/images/products/apple_pressings.jpg
  - http://83.212.109.249:3001/assets/public/images/products/artwork2.jpg
  - ..
- Information Disclosure - Suspicious Comments [10027] total: 2:
  - http://83.212.109.249:3001/main.js
  - http://83.212.109.249:3001/vendor.js
- Modern Web Application [10109] total: 11:
  - http://83.212.109.249:3001/
  - http://83.212.109.249:3001/juice-shop/build/routes/fileServer.js:39:13
  - http://83.212.109.249:3001/juice-shop/build/routes/fileServer.js:55:18
  - http://83.212.109.249:3001/juice-shop/node_modules/express/lib/router/index.js:280:10
  - http://83.212.109.249:3001/juice-shop/node_modules/express/lib/router/index.js:286:9
  - ..
- Non-Storable Content [10049] total: 2:
  - http://83.212.109.249:3001/ftp/eastere.gg
  - http://83.212.109.249:3001/ftp/encrypt.pyc
- Sec-Fetch-Dest Header is Missing [90005] total: 3:
  - http://83.212.109.249:3001/
  - http://83.212.109.249:3001/assets/public/favicon_js.ico
  - http://83.212.109.249:3001/robots.txt
- Sec-Fetch-Mode Header is Missing [90005] total: 3:
  - http://83.212.109.249:3001/
  - http://83.212.109.249:3001/assets/public/favicon_js.ico
  - http://83.212.109.249:3001/robots.txt
- Sec-Fetch-Site Header is Missing [90005] total: 3:
  - http://83.212.109.249:3001/
  - http://83.212.109.249:3001/assets/public/favicon_js.ico
  - http://83.212.109.249:3001/robots.txt
- Sec-Fetch-User Header is Missing [90005] total: 3:
  - http://83.212.109.249:3001/
  - http://83.212.109.249:3001/assets/public/favicon_js.ico
  - http://83.212.109.249:3001/robots.txt
- Storable and Cacheable Content [10049] total: 1:
  - http://83.212.109.249:3001/robots.txt
- Storable but Non-Cacheable Content [10049] total: 9:
  - http://83.212.109.249:3001/
  - http://83.212.109.249:3001/assets/public/favicon_js.ico
  - http://83.212.109.249:3001/ftp/acquisitions.md
  - http://83.212.109.249:3001/main.js
  - http://83.212.109.249:3001/polyfills.js
  - ..
- User Agent Fuzzer [10104] total: 143:
  - http://83.212.109.249:3001/assets
  - http://83.212.109.249:3001/assets
  - http://83.212.109.249:3001/assets
  - http://83.212.109.249:3001/assets
  - http://83.212.109.249:3001/assets
  - ..

View the following link to download the report. RunnerID:11836369786

ZAP by Checkmarx

github-actions[bot] commented 2 days ago

Site: http://cdnjs.cloudflare.com
Site: http://83.212.109.249:3001 New Alerts
- Open Redirect [10028] total: 1:
  - http://83.212.109.249:3001/redirect?to=https://github.com/juice-shop/juice-shop
- Authentication Request Identified [10111] total: 7:
- Session Management Response Identified [10112] total: 1:
  - http://83.212.109.249:3001/rest/continue-code

View the following link to download the report. RunnerID:12082852702