asriz7777 / FXSCRIPTS-TEST-AUTOMATION

0 stars 1 forks source link

Vulnerability [ABAC_Level3] : POST:/api/v1/orgs/requestId/users/requestId/reset-my-password #348

Open asriz7777 opened 5 years ago

asriz7777 commented 5 years ago

Project : FXABAC TEST

Template : ApiV1OrgsRequestidUsersRequestidResetMyPasswordPostMemberuserbDisallowAbact3

Run Id : 8a80808d698f0d6701698fd9c69b23cb

Job : Default

Env : Default

Category : ABAC_Level3

Tags : [FX Top 10 - API Vulnerability, Data_Access_Control]

Severity : Major

Region : FXLabs/US_WEST_1

Result : fail

Status Code : 200

Headers : {X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NDFhZDc5ZDEtMzNmNC00NTUwLTlhN2UtZTBkNDQ2ODUxZDNl; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:13:03 GMT]}

Endpoint : http://13.56.210.25/api/v1/orgs/None/users/None/reset-my-password

Request :
{ "confirmPassword" : "zKSY1Pwt", "createdBy" : "", "createdDate" : "", "email" : "eulah.haag@gmail.com", "id" : "None", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "name" : "zKSY1Pwt", "orgId" : "zKSY1Pwt", "orgRole" : "ENTERPRISE_ADMIN", "password" : "zKSY1Pwt", "username" : "aron.hilpert", "version" : "" }

Response :
{ "requestId" : "None", "requestTime" : "2019-03-18T08:13:03.892+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Format specifier '%s'" } ], "data" : null, "totalPages" : 0, "totalElements" : 0 }

Logs :
2019-03-18 08:13:03 DEBUG [MemberCreateUserAInitAbact3] : URL [http://13.56.210.25/api/v1/orgs/users/addMemberToOrg] 2019-03-18 08:13:03 DEBUG [MemberCreateUserAInitAbact3] : Method [POST] 2019-03-18 08:13:03 DEBUG [MemberCreateUserAInitAbact3] : Request [{ "confirmPassword" : "2FhjIpTu", "createdBy" : "", "createdDate" : "", "email" : "alysha.strosin@gmail.com", "id" : "", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "name" : "2FhjIpTu", "orgId" : "2FhjIpTu", "orgRole" : "READ", "password" : "2FhjIpTu", "username" : "jairo.steuber", "version" : "" }] 2019-03-18 08:13:03 DEBUG [MemberCreateUserAInitAbact3] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic RlhMYWJzLy9hZG1pbkBmeGxhYnMuaW86YWRtaW4xMjMk]}] 2019-03-18 08:13:03 DEBUG [MemberCreateUserAInitAbact3] : Response [{ "requestId" : "None", "requestTime" : "2019-03-18T08:13:03.081+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Invalid request" } ], "data" : false, "totalPages" : 0, "totalElements" : 0 }] 2019-03-18 08:13:03 DEBUG [MemberCreateUserAInitAbact3] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZDk0NGUxMGQtMTliZS00Njk5LThlZjAtMWJkYTBjNDJlOTky; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:13:02 GMT]}] 2019-03-18 08:13:03 DEBUG [MemberCreateUserAInitAbact3] : StatusCode [200] 2019-03-18 08:13:03 DEBUG [MemberCreateUserAInitAbact3] : Time [602] 2019-03-18 08:13:03 DEBUG [MemberCreateUserAInitAbact3] : Size [190] 2019-03-18 08:13:03 INFO [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [200 == 200 OR 200 == 201] result [Passed] 2019-03-18 08:13:03 DEBUG [MemberCreateUserAInitAbact3_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZDk0NGUxMGQtMTliZS00Njk5LThlZjAtMWJkYTBjNDJlOTky; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:13:02 GMT]}] 2019-03-18 08:13:03 DEBUG [MemberCreateUserAInitAbact3_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZDk0NGUxMGQtMTliZS00Njk5LThlZjAtMWJkYTBjNDJlOTky; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:13:02 GMT]}] 2019-03-18 08:13:03 DEBUG [MemberCreateUserAInitAbact3_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZDk0NGUxMGQtMTliZS00Njk5LThlZjAtMWJkYTBjNDJlOTky; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:13:02 GMT]}] 2019-03-18 08:13:03 DEBUG [MemberCreateUserAInitAbact3_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=ZDk0NGUxMGQtMTliZS00Njk5LThlZjAtMWJkYTBjNDJlOTky; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:13:02 GMT]}] 2019-03-18 08:13:03 DEBUG [ApiV1OrgsRequestidUsersRequestidResetMyPasswordPostMemberuserbDisallowAbact3] : URL [http://13.56.210.25/api/v1/orgs/None/users/None/reset-my-password] 2019-03-18 08:13:03 DEBUG [ApiV1OrgsRequestidUsersRequestidResetMyPasswordPostMemberuserbDisallowAbact3] : Method [POST] 2019-03-18 08:13:03 DEBUG [ApiV1OrgsRequestidUsersRequestidResetMyPasswordPostMemberuserbDisallowAbact3] : Request [{ "confirmPassword" : "zKSY1Pwt", "createdBy" : "", "createdDate" : "", "email" : "eulah.haag@gmail.com", "id" : "None", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "name" : "zKSY1Pwt", "orgId" : "zKSY1Pwt", "orgRole" : "ENTERPRISE_ADMIN", "password" : "zKSY1Pwt", "username" : "aron.hilpert", "version" : "" }] 2019-03-18 08:13:03 DEBUG [ApiV1OrgsRequestidUsersRequestidResetMyPasswordPostMemberuserbDisallowAbact3] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-18 08:13:03 DEBUG [ApiV1OrgsRequestidUsersRequestidResetMyPasswordPostMemberuserbDisallowAbact3] : Response [{ "requestId" : "None", "requestTime" : "2019-03-18T08:13:03.892+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Format specifier '%s'" } ], "data" : null, "totalPages" : 0, "totalElements" : 0 }] 2019-03-18 08:13:03 DEBUG [ApiV1OrgsRequestidUsersRequestidResetMyPasswordPostMemberuserbDisallowAbact3] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NDFhZDc5ZDEtMzNmNC00NTUwLTlhN2UtZTBkNDQ2ODUxZDNl; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:13:03 GMT]}] 2019-03-18 08:13:03 DEBUG [ApiV1OrgsRequestidUsersRequestidResetMyPasswordPostMemberuserbDisallowAbact3] : StatusCode [200] 2019-03-18 08:13:03 DEBUG [ApiV1OrgsRequestidUsersRequestidResetMyPasswordPostMemberuserbDisallowAbact3] : Time [544] 2019-03-18 08:13:03 DEBUG [ApiV1OrgsRequestidUsersRequestidResetMyPasswordPostMemberuserbDisallowAbact3] : Size [195] 2019-03-18 08:13:03 ERROR [ApiV1OrgsRequestidUsersRequestidResetMyPasswordPostMemberuserbDisallowAbact3] : Assertion [@StatusCode == 401 OR @StatusCode == 403] resolved-to [200 == 401 OR 200 == 403] result [Failed] 2019-03-18 08:13:04 DEBUG [ApiV1OrgsRequestidDeleteMemberabact3] : URL [http://13.56.210.25/api/v1/orgs/None] 2019-03-18 08:13:04 DEBUG [ApiV1OrgsRequestidDeleteMemberabact3] : Method [DELETE] 2019-03-18 08:13:04 DEBUG [ApiV1OrgsRequestidDeleteMemberabact3] : Request [null] 2019-03-18 08:13:04 DEBUG [ApiV1OrgsRequestidDeleteMemberabact3] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic RlhMYWJzLy9hZG1pbkBmeGxhYnMuaW86YWRtaW4xMjMk]}] 2019-03-18 08:13:04 DEBUG [ApiV1OrgsRequestidDeleteMemberabact3] : Response [{ "requestId" : "None", "requestTime" : "2019-03-18T08:13:04.779+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "No class com.fxlabs.fxt.dao.entity.users.Org entity with id None exists!" } ], "data" : null, "totalPages" : 0, "totalElements" : 0 }] 2019-03-18 08:13:04 DEBUG [ApiV1OrgsRequestidDeleteMemberabact3] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=OTQzYTM3MzktNTAyNC00ZDUxLTk5ZTMtMWQ1ZTIyMDkzZDhk; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:13:04 GMT]}] 2019-03-18 08:13:04 DEBUG [ApiV1OrgsRequestidDeleteMemberabact3] : StatusCode [200] 2019-03-18 08:13:04 DEBUG [ApiV1OrgsRequestidDeleteMemberabact3] : Time [916] 2019-03-18 08:13:04 DEBUG [ApiV1OrgsRequestidDeleteMemberabact3] : Size [246] 2019-03-18 08:13:04 INFO [null] : Assertion [@StatusCode == 200] resolved-to [200 == 200] result [Passed]

--- FX Bot ---