Closed intesar closed 4 years ago
Message : This issue is manually closed from FX control plane.
Title: ABAC_Level1 Vulnerability on GET:/api/v1/branches/{id} Project: NetBanking API Description:
Assertion Name: Attribute Based Access Control 1 (ABAC) ( 1 )
Title: ABAC_Level1 Vulnerability on GET:/api/v1/branches/{id} Project: NetBanking API Description: The ABAC exploit allows an attacker to read, modify, delete, add and perform actions on customer/un-authorized data.
Assertion Name: Attribute Based Access Control 1 (ABAC) ( 1 )Overview: Access Control (or Authorization) is the process of granting or denying specific requests from a user, program, or process. Access control also involves the act of granting and revoking those privileges. Attribute Based Access Control (ABAC) will grant or deny user requests based on arbitrary attributes of the user and arbitrary attributes of the object, and environment conditions that may be globally recognized and more relevant to the policies at hand.
'Attribute-based-access-control 1' identifies top-level/non-dependent resource/data/record vulnerabilities. Looks for private user/account data being illegally read, written, updated, deleted or operated by other users or tenants or accounts.
This scanner requires a private-account/user to create private data/resources e.g. UserA. And it also requires other users who shouldn't have any access to UserA's data like UserB, UserC, & UserD based on your App multi-tenancy model. e.g. UserA can be a user from tenant/org-a and UserB can be a user in tenant-b and UserC can be a user in tenant-c with admin privileges.
APIs tend to expose endpoints that handle object identifiers, creating a wide attack surface Level Access Control issue. Object-level authorization checks should be considered in every function that accesses a data source using input from the user.
Severity: OWASP 2019 API Top 10 ranks ABAC vulnerabilities at Top 1 position and is named Broken Object Level Authorization. ( 2 )
Vulnerability Impact: With flawed or broken ABAC security control policy in place, The following are some of the consequences.
Remediation: The following techniques may be checked for ensuring RBAC is in place ( 2 ) ( 3 ) ( 4 ).
Risk: ABAC_Level1 Severity: High API Endpoint: http://95.217.118.53:8080/api/v1/branches/2c928084730547e801744a534f470751 Environment: Master Playbook: ApiV1BranchesIdGetUseraCreateBranchUsercDisallowAbac Researcher: [apisec Bot] QUICK TIPS Suggestion: Add access-control checks on incoming requests against all data calls. Effort Estimate: 2.0 Wire Logs: 03:40:07 [D] [ BCUAIAbac] : URL [http://95.217.118.53:8080/api/v1/branches] 03:40:07 [D] [ BCUAIAbac] : Method [POST] 03:40:07 [D] [ BCUAIAbac] : Auth [UserA] 03:40:07 [D] [ BCUAIAbac] : Request [{ "access" : "xht4umUj", "atmAtBranch" : "xht4umUj", "branchMediatedServiceName" : "xht4umUj", "branchName" : "xht4umUj", "branchType" : "xht4umUj", "createdBy" : "", "createdDate" : "", "customerSegment" : "xht4umUj", "faxNumber" : "xht4umUj", "id" : "", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "version" : "" }] 03:40:07 [D] [ BCUAIAbac] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[**********]}] 03:40:07 [D] [ BCUAIAbac] : Response [{ "requestId" : "None", "requestTime" : "2020-09-01T15:40:07.881+0000", "errors" : false, "messages" : [ ], "data" : { "id" : "2c928084730547e801744a534f470751", "createdBy" : "2c928085730548680173054c9f720003", "createdDate" : "2020-09-01T15:40:07.879+0000", "modifiedBy" : "2c928085730548680173054c9f720003", "modifiedDate" : "2020-09-01T15:40:07.879+0000", "version" : null, "inactive" : false, "access" : "wRxoAi1f", "atmAtBranch" : "wRxoAi1f", "branchName" : "wRxoAi1f", "branchMediatedServiceName" : "wRxoAi1f", "branchType" : "wRxoAi1f", "customerSegment" : "wRxoAi1f", "faxNumber" : "wRxoAi1f" }, "totalPages" : 0, "totalElements" : 0 }] 03:40:07 [D] [ BCUAIAbac] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MWQxZjRkMjQtOGUzYi00NTRiLWJiNjQtOGMwNzQ4ZmY3OTAz; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Tue, 01 Sep 2020 15:40:07 GMT]}] 03:40:07 [D] [ BCUAIAbac] : StatusCode [200] 03:40:07 [D] [ BCUAIAbac] : Time [175] 03:40:07 [D] [ BCUAIAbac] : Size [578] 03:40:07 [I] [ BCUAIAbac] : Assertion [@StatusCode == 200 AND @Response.errors == false] resolved-to [200 == 200 AND false == false] result [Passed] 03:40:07 [D] [BCUAIAHeaders] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MWQxZjRkMjQtOGUzYi00NTRiLWJiNjQtOGMwNzQ4ZmY3OTAz; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Tue, 01 Sep 2020 15:40:07 GMT]}] 03:40:07 [D] [BCUAIAHeaders] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MWQxZjRkMjQtOGUzYi00NTRiLWJiNjQtOGMwNzQ4ZmY3OTAz; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Tue, 01 Sep 2020 15:40:07 GMT]}] 03:40:07 [D] [ BCUAIA]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MWQxZjRkMjQtOGUzYi00NTRiLWJiNjQtOGMwNzQ4ZmY3OTAz; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Tue, 01 Sep 2020 15:40:07 GMT]}] 03:40:07 [D] [ BCUAIA]] : Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MWQxZjRkMjQtOGUzYi00NTRiLWJiNjQtOGMwNzQ4ZmY3OTAz; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Tue, 01 Sep 2020 15:40:07 GMT]}] 03:40:08 [D] [AVBIGUCBUDAbac] : URL [http://95.217.118.53:8080/api/v1/branches/2c928084730547e801744a534f470751] 03:40:08 [D] [AVBIGUCBUDAbac] : Method [GET] 03:40:08 [D] [AVBIGUCBUDAbac] : Auth [UserC] 03:40:08 [D] [AVBIGUCBUDAbac] : Request [] 03:40:08 [D] [AVBIGUCBUDAbac] : Request-Headers [{Accept=[application/json], Content-Type=[application/json], Authorization=[**********]}] 03:40:08 [D] [AVBIGUCBUDAbac] : Response [{ "requestId" : "None", "requestTime" : "2020-09-01T15:40:08.058+0000", "errors" : false, "messages" : [ ], "data" : { "id" : "2c928084730547e801744a534f470751", "createdBy" : "2c928085730548680173054c9f720003", "createdDate" : "2020-09-01T15:40:07.879+0000", "modifiedBy" : "2c928085730548680173054c9f720003", "modifiedDate" : "2020-09-01T15:40:07.879+0000", "version" : null, "inactive" : false, "access" : "wRxoAi1f", "atmAtBranch" : "wRxoAi1f", "branchName" : "wRxoAi1f", "branchMediatedServiceName" : "wRxoAi1f", "branchType" : "wRxoAi1f", "customerSegment" : "wRxoAi1f", "faxNumber" : "wRxoAi1f" }, "totalPages" : 0, "totalElements" : 0 }] 03:40:08 [D] [AVBIGUCBUDAbac] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MDU3YjMyYTUtMWExNS00ODNiLTlmM2QtMDFmODY1ODU4Y2I1; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Tue, 01 Sep 2020 15:40:07 GMT]}] 03:40:08 [D] [AVBIGUCBUDAbac] : StatusCode [200] 03:40:08 [D] [AVBIGUCBUDAbac] : Time [175] 03:40:08 [D] [AVBIGUCBUDAbac] : Size [578] 03:40:08 [E] [AVBIGUCBUDAbac] : Assertion [@StatusCode == 401 OR @StatusCode == 404 OR @Response.errors == true] resolved-to [200 == 401 OR 200 == 404 OR false == true] result [Failed] 03:40:08 [D] [AVBIDBAAbac] : URL [http://95.217.118.53:8080/api/v1/branches/2c928084730547e801744a534f470751] 03:40:08 [D] [AVBIDBAAbac] : Method [DELETE] 03:40:08 [D] [AVBIDBAAbac] : Request [null] 03:40:08 [D] [AVBIDBAAbac] : Auth [UserA] 03:40:08 [D] [AVBIDBAAbac] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic dXNlcjFAbmV0YmFua2luZy5pbzphZG1pbjEyMyQ=]}] 03:40:08 [D] [AVBIDBAAbac] : Response [{ "requestId" : "None", "requestTime" : "2020-09-01T15:40:08.227+0000", "errors" : false, "messages" : [ ], "data" : null, "totalPages" : 0, "totalElements" : 0 }] 03:40:08 [D] [AVBIDBAAbac] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Set-Cookie=[SESSION=MjQ3YTVmNDctNTEwZC00MjIwLWJkZWUtY2RmOWNlNTY5N2Jl; Path=/; HttpOnly], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Tue, 01 Sep 2020 15:40:07 GMT]}] 03:40:08 [D] [AVBIDBAAbac] : StatusCode [200] 03:40:08 [D] [AVBIDBAAbac] : Time [169] 03:40:08 [D] [AVBIDBAAbac] : Size [139] 03:40:08 [I] [AVBIGUCBUDAbac] : Assertion [@StatusCode == 200] resolved-to [200 == 200] result [Passed] IMPORTANT LINKS Vulnerability Details: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/recommendations/8a8081a4743534b601744a5359151e15/details Project: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/jobs Environment: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/environments/8a8081766fc3e2a1016fc421d7155a15/edit Scan Dashboard: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/jobs/8a8081766fc3e2a1016fc4230f426628/runs/8a8081a4743534b601744a5320d81dc7 Playbook: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/template/ApiV1BranchesIdGetUseraCreateBranchUsercDisallowAbac Coverage: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/configuration Code Sample: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/recommendations/8a8081a4743534b601744a5359151e15/codesamples PS: Please contact support@apisec.ai for apisec access and login issues. --- apisec Bot ---