asriz7777 / FXSCRIPTS-TEST-AUTOMATION

0 stars 1 forks source link

Vulnerability [ABAC_Level3] : POST:/api/v1/orgs/requestId/users/requestId/reset-password #339

Open asriz7777 opened 5 years ago

asriz7777 commented 5 years ago

Project : FXABAC TEST

Template : ApiV1OrgsRequestidUsersRequestidResetPasswordPostMemberuserbDisallowAbact3

Run Id : 8a80808d698f0d6701698fd9c69b23cb

Job : Default

Env : Default

Category : ABAC_Level3

Tags : [FX Top 10 - API Vulnerability, Data_Access_Control]

Severity : Major

Region : FXLabs/US_WEST_1

Result : fail

Status Code : 200

Headers : {X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=Yjk2MDU0ZTAtN2JiYS00N2RiLThmMGQtMGJkODFmODRmYWVi; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:12:52 GMT]}

Endpoint : http://13.56.210.25/api/v1/orgs/None/users/None/reset-password

Request :
{ "confirmPassword" : "k472i5r1", "createdBy" : "", "createdDate" : "", "email" : "kane.pouros@gmail.com", "id" : "None", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "name" : "k472i5r1", "orgId" : "k472i5r1", "orgRole" : "ENTERPRISE_ADMIN", "password" : "k472i5r1", "username" : "lila.bergnaum", "version" : "" }

Response :
{ "requestId" : "None", "requestTime" : "2019-03-18T08:12:52.121+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Format specifier '%s'" } ], "data" : null, "totalPages" : 0, "totalElements" : 0 }

Logs :
2019-03-18 08:12:51 DEBUG [MemberCreateUserAInitAbact3] : URL [http://13.56.210.25/api/v1/orgs/users/addMemberToOrg] 2019-03-18 08:12:51 DEBUG [MemberCreateUserAInitAbact3] : Method [POST] 2019-03-18 08:12:51 DEBUG [MemberCreateUserAInitAbact3] : Request [{ "confirmPassword" : "wFBU1TGn", "createdBy" : "", "createdDate" : "", "email" : "sibyl.hoeger@gmail.com", "id" : "", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "name" : "wFBU1TGn", "orgId" : "wFBU1TGn", "orgRole" : "READ", "password" : "wFBU1TGn", "username" : "carmen.yundt", "version" : "" }] 2019-03-18 08:12:51 DEBUG [MemberCreateUserAInitAbact3] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic RlhMYWJzLy9hZG1pbkBmeGxhYnMuaW86YWRtaW4xMjMk]}] 2019-03-18 08:12:51 DEBUG [MemberCreateUserAInitAbact3] : Response [{ "requestId" : "None", "requestTime" : "2019-03-18T08:12:51.109+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Invalid request" } ], "data" : false, "totalPages" : 0, "totalElements" : 0 }] 2019-03-18 08:12:51 DEBUG [MemberCreateUserAInitAbact3] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZGYzMjRlNDMtMjdhYi00NzgyLTg3MzAtYTVlMTM2NjY0MWE0; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:12:51 GMT]}] 2019-03-18 08:12:51 DEBUG [MemberCreateUserAInitAbact3] : StatusCode [200] 2019-03-18 08:12:51 DEBUG [MemberCreateUserAInitAbact3] : Time [783] 2019-03-18 08:12:51 DEBUG [MemberCreateUserAInitAbact3] : Size [190] 2019-03-18 08:12:51 INFO [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [200 == 200 OR 200 == 201] result [Passed] 2019-03-18 08:12:51 DEBUG [MemberCreateUserAInitAbact3_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZGYzMjRlNDMtMjdhYi00NzgyLTg3MzAtYTVlMTM2NjY0MWE0; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:12:51 GMT]}] 2019-03-18 08:12:51 DEBUG [MemberCreateUserAInitAbact3_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZGYzMjRlNDMtMjdhYi00NzgyLTg3MzAtYTVlMTM2NjY0MWE0; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:12:51 GMT]}] 2019-03-18 08:12:51 DEBUG [MemberCreateUserAInitAbact3_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZGYzMjRlNDMtMjdhYi00NzgyLTg3MzAtYTVlMTM2NjY0MWE0; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:12:51 GMT]}] 2019-03-18 08:12:51 DEBUG [MemberCreateUserAInitAbact3_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZGYzMjRlNDMtMjdhYi00NzgyLTg3MzAtYTVlMTM2NjY0MWE0; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:12:51 GMT]}] 2019-03-18 08:12:52 DEBUG [ApiV1OrgsRequestidUsersRequestidResetPasswordPostMemberuserbDisallowAbact3] : URL [http://13.56.210.25/api/v1/orgs/None/users/None/reset-password] 2019-03-18 08:12:52 DEBUG [ApiV1OrgsRequestidUsersRequestidResetPasswordPostMemberuserbDisallowAbact3] : Method [POST] 2019-03-18 08:12:52 DEBUG [ApiV1OrgsRequestidUsersRequestidResetPasswordPostMemberuserbDisallowAbact3] : Request [{ "confirmPassword" : "k472i5r1", "createdBy" : "", "createdDate" : "", "email" : "kane.pouros@gmail.com", "id" : "None", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "name" : "k472i5r1", "orgId" : "k472i5r1", "orgRole" : "ENTERPRISE_ADMIN", "password" : "k472i5r1", "username" : "lila.bergnaum", "version" : "" }] 2019-03-18 08:12:52 DEBUG [ApiV1OrgsRequestidUsersRequestidResetPasswordPostMemberuserbDisallowAbact3] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-18 08:12:52 DEBUG [ApiV1OrgsRequestidUsersRequestidResetPasswordPostMemberuserbDisallowAbact3] : Response [{ "requestId" : "None", "requestTime" : "2019-03-18T08:12:52.121+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Format specifier '%s'" } ], "data" : null, "totalPages" : 0, "totalElements" : 0 }] 2019-03-18 08:12:52 DEBUG [ApiV1OrgsRequestidUsersRequestidResetPasswordPostMemberuserbDisallowAbact3] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=Yjk2MDU0ZTAtN2JiYS00N2RiLThmMGQtMGJkODFmODRmYWVi; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:12:52 GMT]}] 2019-03-18 08:12:52 DEBUG [ApiV1OrgsRequestidUsersRequestidResetPasswordPostMemberuserbDisallowAbact3] : StatusCode [200] 2019-03-18 08:12:52 DEBUG [ApiV1OrgsRequestidUsersRequestidResetPasswordPostMemberuserbDisallowAbact3] : Time [951] 2019-03-18 08:12:52 DEBUG [ApiV1OrgsRequestidUsersRequestidResetPasswordPostMemberuserbDisallowAbact3] : Size [195] 2019-03-18 08:12:52 ERROR [ApiV1OrgsRequestidUsersRequestidResetPasswordPostMemberuserbDisallowAbact3] : Assertion [@StatusCode == 401 OR @StatusCode == 403] resolved-to [200 == 401 OR 200 == 403] result [Failed] 2019-03-18 08:12:53 DEBUG [ApiV1OrgsRequestidDeleteMemberabact3] : URL [http://13.56.210.25/api/v1/orgs/None] 2019-03-18 08:12:53 DEBUG [ApiV1OrgsRequestidDeleteMemberabact3] : Method [DELETE] 2019-03-18 08:12:53 DEBUG [ApiV1OrgsRequestidDeleteMemberabact3] : Request [null] 2019-03-18 08:12:53 DEBUG [ApiV1OrgsRequestidDeleteMemberabact3] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic RlhMYWJzLy9hZG1pbkBmeGxhYnMuaW86YWRtaW4xMjMk]}] 2019-03-18 08:12:53 DEBUG [ApiV1OrgsRequestidDeleteMemberabact3] : Response [{ "requestId" : "None", "requestTime" : "2019-03-18T08:12:52.972+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "No class com.fxlabs.fxt.dao.entity.users.Org entity with id None exists!" } ], "data" : null, "totalPages" : 0, "totalElements" : 0 }] 2019-03-18 08:12:53 DEBUG [ApiV1OrgsRequestidDeleteMemberabact3] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MTRmODM5NGEtNDgzOC00ZmU1LWIwMjUtNGMyMTU2ODAzMzg2; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:12:52 GMT]}] 2019-03-18 08:12:53 DEBUG [ApiV1OrgsRequestidDeleteMemberabact3] : StatusCode [200] 2019-03-18 08:12:53 DEBUG [ApiV1OrgsRequestidDeleteMemberabact3] : Time [786] 2019-03-18 08:12:53 DEBUG [ApiV1OrgsRequestidDeleteMemberabact3] : Size [246] 2019-03-18 08:12:53 INFO [null] : Assertion [@StatusCode == 200] resolved-to [200 == 200] result [Passed]

--- FX Bot ---