Stop half-done APIs! Cherrybomb is a CLI tool that helps you avoid undefined user behaviour by auditing your API specifications, validating them and running API security tests.
@RazMag
Description of the bug
The change_payload function in Active test fail to parse the JSON.
I wrote a check for xss, during the running time I got an error "cannot access key "" in JSON array.
To Reproduce
Go to swagger/src/active/additional_checks.rs
Paste the following code , the code crash when the function change_payload is called.
My function is the same as the min_max function check.
pub async fn check_xss_reflected(&self, auth: &Authorization) -> CheckRetVal{ let mut ret_val = CheckRetVal::default(); for oas_map in self.payloads.iter() { for (json_path, schema) in &oas_map.payload.map { for (m, _) in oas_map .path .path_item .get_ops() .iter() .filter(|(m, _)| m == &Method::POST) .filter(|(m,_)|schema.schema_type == Some("string".to_string())) { let url; if let Some(servers) = &self.oas.servers() { if let Some(s) = servers.first() { url = s.url.clone(); } else { continue; }; } else { continue; }; let test_vals= ("payload", "<script>alert()</script>") let req = AttackRequest::builder() .uri(&url, &oas_map.path.path) .method(*m) .headers(vec![]) .parameters(vec![]) .auth(auth.clone()) .payload( &change_payload(&oas_map.payload.payload, json_path, json!(test_vals.1)).to_string(), ) .build();
Expected behavior
The code panicked with this error: thread 'main' panicked at 'cannot access key "firstName" in JSON array'.
Screenshots
Additional context
During the debugging it appears that the json path value has an empty string (screenshot).
The source's problem is difficult to detect because the problematic "key" change at each execution of the program.( see the second screenshot)
@RazMag Description of the bug The change_payload function in Active test fail to parse the JSON. I wrote a check for xss, during the running time I got an error "cannot access key "" in JSON array.
To Reproduce Go to swagger/src/active/additional_checks.rs Paste the following code , the code crash when the function change_payload is called. My function is the same as the min_max function check.
pub async fn check_xss_reflected(&self, auth: &Authorization) -> CheckRetVal{ let mut ret_val = CheckRetVal::default(); for oas_map in self.payloads.iter() { for (json_path, schema) in &oas_map.payload.map { for (m, _) in oas_map .path .path_item .get_ops() .iter() .filter(|(m, _)| m == &Method::POST) .filter(|(m,_)|schema.schema_type == Some("string".to_string())) { let url; if let Some(servers) = &self.oas.servers() { if let Some(s) = servers.first() { url = s.url.clone(); } else { continue; }; } else { continue; }; let test_vals= ("payload", "<script>alert()</script>") let req = AttackRequest::builder() .uri(&url, &oas_map.path.path) .method(*m) .headers(vec![]) .parameters(vec![]) .auth(auth.clone()) .payload( &change_payload(&oas_map.payload.payload, json_path, json!(test_vals.1)).to_string(), ) .build();
Expected behavior The code panicked with this error: thread 'main' panicked at 'cannot access key "firstName" in JSON array'.
Screenshots
![image](https://user-images.githubusercontent.com/46570579/182592162-0c952f7f-65e2-4b12-9295-3ae35fd3e239.png)
Additional context During the debugging it appears that the json path value has an empty string (screenshot). The source's problem is difficult to detect because the problematic "key" change at each execution of the program.( see the second screenshot)