search

asriz7777 / FXSCRIPTS-TEST-AUTOMATION

0 stars 1 forks source link

Vulnerability [ABAC_Level1] : GET:/api/v1/orgs/{id}/users #350

Open asriz7777 opened 5 years ago

asriz7777 commented 5 years ago

Project : FXABAC TEST

Template : ApiV1OrgsIdUsersGetUseraCreateOrgUserbDisallowAbac

Run Id : 8a80808d698f0d6701698fd9c69b23cb

Job : Default

Env : Default

Category : ABAC_Level1

Tags : [FX Top 10 - API Vulnerability, Data_Access_Control]

Severity : Major

Region : FXLabs/US_WEST_1

Result : fail

Status Code : 200

Headers : {X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NjQyMTFlMWMtYWQ5ZS00MWQ0LTlmMGQtYTk0ZTNhMTUxYjA3; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:13:07 GMT]}

Endpoint : http://13.56.210.25/api/v1/orgs/8a808085698f12b501698fdc820c0787/users?page=0&pageSize=20

Request :

Response :
{ "requestId" : "None", "requestTime" : "2019-03-18T08:13:07.593+0000", "errors" : false, "messages" : [ ], "data" : [ { "id" : "8a808085698f12b501698fdc820e0788", "createdBy" : "8a8080ce6708016501670804cd590000", "createdDate" : "2019-03-18T08:13:06.958+0000", "modifiedBy" : "8a8080ce6708016501670804cd590000", "modifiedDate" : "2019-03-18T08:13:06.958+0000", "version" : null, "inactive" : false, "org" : { "id" : "8a808085698f12b501698fdc820c0787", "createdBy" : "8a8080ce6708016501670804cd590000", "createdDate" : "2019-03-18T08:13:06.956+0000", "modifiedBy" : "8a8080ce6708016501670804cd590000", "modifiedDate" : "2019-03-18T08:13:06.956+0000", "version" : null, "inactive" : false, "name" : "50JGOiB0" }, "users" : { "id" : "8a8080ce6708016501670804cd590000", "createdBy" : "anonymousUser", "createdDate" : "2018-11-12T13:03:11.703+0000", "modifiedBy" : "anonymousUser", "modifiedDate" : "2018-11-12T13:03:11.703+0000", "version" : null, "inactive" : false, "name" : null, "email" : "admin@fxlabs.io", "username" : "admin", "company" : null, "location" : null, "jobTitle" : null }, "orgRole" : "ADMIN", "status" : "ACTIVE", "userType" : "MANAGED", "forceResetPwd" : false } ], "totalPages" : 1, "totalElements" : 1 }

Logs :
2019-03-18 08:13:06 DEBUG [ OrgCreateUserAInitAbac] : URL [http://13.56.210.25/api/v1/orgs] 2019-03-18 08:13:06 DEBUG [ OrgCreateUserAInitAbac] : Method [POST] 2019-03-18 08:13:06 DEBUG [ OrgCreateUserAInitAbac] : Request [{ "billingEmail" : "isabell.von@hotmail.com", "company" : "Kub-Kub", "createdBy" : "", "createdDate" : "", "description" : "50JGOiB0", "id" : "", "inactive" : false, "location" : "50JGOiB0", "modifiedBy" : "", "modifiedDate" : "", "name" : "50JGOiB0", "orgPlan" : "FREE", "orgType" : "ENTERPRISE", "version" : "" }] 2019-03-18 08:13:06 DEBUG [ OrgCreateUserAInitAbac] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic RlhMYWJzLy9hZG1pbkBmeGxhYnMuaW86YWRtaW4xMjMk]}] 2019-03-18 08:13:06 DEBUG [ OrgCreateUserAInitAbac] : Response [{ "requestId" : "None", "requestTime" : "2019-03-18T08:13:06.957+0000", "errors" : false, "messages" : [ ], "data" : { "id" : "8a808085698f12b501698fdc820c0787", "createdBy" : "8a8080ce6708016501670804cd590000", "createdDate" : "2019-03-18T08:13:06.956+0000", "modifiedBy" : "8a8080ce6708016501670804cd590000", "modifiedDate" : "2019-03-18T08:13:06.956+0000", "version" : null, "inactive" : false, "name" : "50JGOiB0", "description" : "50JGOiB0", "orgType" : "ENTERPRISE", "billingEmail" : "isabell.von@hotmail.com", "company" : "Kub-Kub", "location" : "50JGOiB0", "orgPlan" : "ENTERPRISE" }, "totalPages" : 0, "totalElements" : 0 }] 2019-03-18 08:13:06 DEBUG [ OrgCreateUserAInitAbac] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MmYwYTdjYmItZmRjMi00NjYxLTk1ZjEtODE4N2NlZDcyNzIy; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:13:06 GMT]}] 2019-03-18 08:13:06 DEBUG [ OrgCreateUserAInitAbac] : StatusCode [200] 2019-03-18 08:13:06 DEBUG [ OrgCreateUserAInitAbac] : Time [1006] 2019-03-18 08:13:06 DEBUG [ OrgCreateUserAInitAbac] : Size [566] 2019-03-18 08:13:06 INFO [null] : Assertion [@StatusCode == 200 AND @Response.errors == false] resolved-to [200 == 200 AND false == false] result [Passed] 2019-03-18 08:13:06 DEBUG [OrgCreateUserAInitAbac_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MmYwYTdjYmItZmRjMi00NjYxLTk1ZjEtODE4N2NlZDcyNzIy; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:13:06 GMT]}] 2019-03-18 08:13:06 DEBUG [OrgCreateUserAInitAbac_Headers] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MmYwYTdjYmItZmRjMi00NjYxLTk1ZjEtODE4N2NlZDcyNzIy; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:13:06 GMT]}] 2019-03-18 08:13:06 DEBUG [OrgCreateUserAInitAbac_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MmYwYTdjYmItZmRjMi00NjYxLTk1ZjEtODE4N2NlZDcyNzIy; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:13:06 GMT]}] 2019-03-18 08:13:06 DEBUG [OrgCreateUserAInitAbac_Headers[2]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MmYwYTdjYmItZmRjMi00NjYxLTk1ZjEtODE4N2NlZDcyNzIy; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:13:06 GMT]}] 2019-03-18 08:13:07 DEBUG [ApiV1OrgsIdUsersGetUseraCreateOrgUserbDisallowAbac] : URL [http://13.56.210.25/api/v1/orgs/8a808085698f12b501698fdc820c0787/users?page=0&pageSize=20] 2019-03-18 08:13:07 DEBUG [ApiV1OrgsIdUsersGetUseraCreateOrgUserbDisallowAbac] : Method [GET] 2019-03-18 08:13:07 DEBUG [ApiV1OrgsIdUsersGetUseraCreateOrgUserbDisallowAbac] : Request [] 2019-03-18 08:13:07 DEBUG [ApiV1OrgsIdUsersGetUseraCreateOrgUserbDisallowAbac] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic T1JHQi8vdXNlckJAdGVzdGxhYnMuaW86b3JnMTIzNCQ=]}] 2019-03-18 08:13:07 DEBUG [ApiV1OrgsIdUsersGetUseraCreateOrgUserbDisallowAbac] : Response [{ "requestId" : "None", "requestTime" : "2019-03-18T08:13:07.593+0000", "errors" : false, "messages" : [ ], "data" : [ { "id" : "8a808085698f12b501698fdc820e0788", "createdBy" : "8a8080ce6708016501670804cd590000", "createdDate" : "2019-03-18T08:13:06.958+0000", "modifiedBy" : "8a8080ce6708016501670804cd590000", "modifiedDate" : "2019-03-18T08:13:06.958+0000", "version" : null, "inactive" : false, "org" : { "id" : "8a808085698f12b501698fdc820c0787", "createdBy" : "8a8080ce6708016501670804cd590000", "createdDate" : "2019-03-18T08:13:06.956+0000", "modifiedBy" : "8a8080ce6708016501670804cd590000", "modifiedDate" : "2019-03-18T08:13:06.956+0000", "version" : null, "inactive" : false, "name" : "50JGOiB0" }, "users" : { "id" : "8a8080ce6708016501670804cd590000", "createdBy" : "anonymousUser", "createdDate" : "2018-11-12T13:03:11.703+0000", "modifiedBy" : "anonymousUser", "modifiedDate" : "2018-11-12T13:03:11.703+0000", "version" : null, "inactive" : false, "name" : null, "email" : "admin@fxlabs.io", "username" : "admin", "company" : null, "location" : null, "jobTitle" : null }, "orgRole" : "ADMIN", "status" : "ACTIVE", "userType" : "MANAGED", "forceResetPwd" : false } ], "totalPages" : 1, "totalElements" : 1 }] 2019-03-18 08:13:07 DEBUG [ApiV1OrgsIdUsersGetUseraCreateOrgUserbDisallowAbac] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=NjQyMTFlMWMtYWQ5ZS00MWQ0LTlmMGQtYTk0ZTNhMTUxYjA3; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:13:07 GMT]}] 2019-03-18 08:13:07 DEBUG [ApiV1OrgsIdUsersGetUseraCreateOrgUserbDisallowAbac] : StatusCode [200] 2019-03-18 08:13:07 DEBUG [ApiV1OrgsIdUsersGetUseraCreateOrgUserbDisallowAbac] : Time [637] 2019-03-18 08:13:07 DEBUG [ApiV1OrgsIdUsersGetUseraCreateOrgUserbDisallowAbac] : Size [1093] 2019-03-18 08:13:07 ERROR [ApiV1OrgsIdUsersGetUseraCreateOrgUserbDisallowAbac] : Assertion [@StatusCode == 401 OR @StatusCode == 403 OR @Response.errors == true] resolved-to [200 == 401 OR 200 == 403 OR false == true] result [Failed] 2019-03-18 08:13:08 DEBUG [ApiV1OrgsIdDeleteOrgAbstractAbac] : URL [http://13.56.210.25/api/v1/orgs/8a808085698f12b501698fdc820c0787] 2019-03-18 08:13:08 DEBUG [ApiV1OrgsIdDeleteOrgAbstractAbac] : Method [DELETE] 2019-03-18 08:13:08 DEBUG [ApiV1OrgsIdDeleteOrgAbstractAbac] : Request [null] 2019-03-18 08:13:08 DEBUG [ApiV1OrgsIdDeleteOrgAbstractAbac] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic RlhMYWJzLy9hZG1pbkBmeGxhYnMuaW86YWRtaW4xMjMk]}] 2019-03-18 08:13:08 DEBUG [ApiV1OrgsIdDeleteOrgAbstractAbac] : Response [{ "requestId" : "None", "requestTime" : "2019-03-18T08:13:08.816+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Resource name or key already exists." } ], "data" : null, "totalPages" : 0, "totalElements" : 0 }] 2019-03-18 08:13:08 DEBUG [ApiV1OrgsIdDeleteOrgAbstractAbac] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=OTU5N2ExZWEtMTZiYi00ZTFlLWE1ZDYtZTlhZDM3OTQ2MDgy; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Mon, 18 Mar 2019 08:13:08 GMT]}] 2019-03-18 08:13:08 DEBUG [ApiV1OrgsIdDeleteOrgAbstractAbac] : StatusCode [200] 2019-03-18 08:13:08 DEBUG [ApiV1OrgsIdDeleteOrgAbstractAbac] : Time [1227] 2019-03-18 08:13:08 DEBUG [ApiV1OrgsIdDeleteOrgAbstractAbac] : Size [210] 2019-03-18 08:13:08 INFO [null] : Assertion [@StatusCode == 200] resolved-to [200 == 200] result [Passed]

--- FX Bot ---