search

intesar / NB-Sales

0 stars 0 forks source link

Unsecured on POST:/api/v1/users/personal-sign-up #1469

Closed intesar closed 4 years ago

intesar commented 4 years ago

Title: Unsecured Vulnerability on POST:/api/v1/users/personal-sign-up Project: NetBanking API Description: The unsecured exploit gives an attacker full access to the vulnerable endpoint without credentials.

Assertion Name: Unsecured Endpoints ( 1 )

Overview: RESTful API is an application program interface (API) that uses HTTP requests to GET, PUT, POST, and DELETE data. A RESTful API — also referred to as a RESTful web service — is based on representational state transfer (REST) technology, an architectural style and approach to communications often used in web services development. These exposed endpoints should not be open to all and should be protected. A top priority for the organizations is to have Secured Endpoints.

The 'Unsecured Endpoint' scanning identifies vulnerabilities resulting from the non-protected endpoints. These endpoints requires no authentication scheme and are open for both authenticated and non-authenticated requests.

Authentication mechanisms are often implemented incorrectly, allowing attackers to compromise authentication tokens or to exploit implementation flaws to assume other user's identities temporarily or permanently. Compromising system's ability to identify the client/user, compromises API security overall.

Security misconfiguration is commonly a result of insecure default configurations, incomplete or ad-hoc configurations, open cloud storage, misconfigured HTTP headers, unnecessary HTTP methods, permissive Cross-Origin resource sharing (CORS), and verbose error messages containing sensitive information.

Severity: The difficulty of achieving API security has increased exponentially and unprotected APIs are one of the top web application security risks organizations face. OWASP included “Unprotected APIs” in its proposal for 2017 top 10 list. ( 2 )

Vulnerability Impact: Every exposed API end-point will have some action to be performed thru appropriate HTTP method and not all methods are valid for every single end-point. Left unchecked and opened for access to all, the following are some of the consequences ( 3 ).


Exploitation: Almost all kinds of authentication, injection, encryption, configuration, access control, and other issues can possible in the RESTful APIs as like the traditional application. Since APIs includes complex data structures and protocols, the security testing may become cumbersome for an attacker. But it is quite possible to analyze APIs and discover vulnerabilities and exploit ( 4 ).

Remediation: The following techniques may be utilized for having Secured Endpoints ( 3 ) ( 5 ) ( 6 ).

References:
  1. Representational State Transfer (REST) - https://en.wikipedia.org/wiki/Representational_state_transfer
  2. OWASP 2017 Top 10 Proposal –Unprotected APIs - https://www.owasp.org/index.php?title=Top_10_2017-A10-Underprotected_APIs&oldid=228947
  3. RESTful API Security - https://dzone.com/articles/restful-api-security
  4. API Exploits - https://www.hack2secure.com/blogs/what-are-api-exploits
  5. REST API Security Guidelines - https://dzone.com/articles/top-5-rest-api-security-guidelines
  6. OWASP REST Security Cheat Sheet - https://www.owasp.org/index.php/REST_Security_Cheat_Sheet

Risk: Unsecured Severity: Critical API Endpoint: http://95.217.118.53:8080/api/v1/users/personal-sign-up Environment: Master Playbook: ApiV1UsersPersonalSignUpPostAnonymousInvalid Researcher: [apisec Bot] QUICK TIPS Suggestion: Make sure the endpoint is secured as part of the authentication framework. Effort Estimate: 2.0 Wire Logs: 04:46:44 [D] [AVUPSUPAInvalid] : URL [http://95.217.118.53:8080/api/v1/users/personal-sign-up] 04:46:44 [D] [AVUPSUPAInvalid] : Method [POST] 04:46:44 [D] [AVUPSUPAInvalid] : Auth [] 04:46:44 [D] [AVUPSUPAInvalid] : Request [{ "accountNonExpired" : false, "accountNonLocked" : false, "company" : "Hermann LLC", "createdBy" : "", "createdDate" : "", "credentialsNonExpired" : false, "email" : "maryjane.hamill@gmail.com", "enabled" : false, "id" : "", "inactive" : false, "jobTitle" : "Education Analyst", "location" : "Vi5rPKuG", "modifiedBy" : "", "modifiedDate" : "", "name" : "Vi5rPKuG", "password" : "9TVRZ2pCKKU_", "privileges" : [ "Vi5rPKuG" ], "username" : "evert.pouros", "version" : "" }] 04:46:44 [D] [AVUPSUPAInvalid] : Request-Headers [{Accept=[application/json], Content-Type=[application/json]}] 04:46:44 [D] [AVUPSUPAInvalid] : Response [{ "requestId" : "None", "requestTime" : "2020-09-02T16:46:44.731+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Org name [Schulist, Schulist and Schulist] exists." } ], "data" : false, "totalPages" : 0, "totalElements" : 0 }] 04:46:44 [D] [AVUPSUPAInvalid] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 02 Sep 2020 16:46:43 GMT]}] 04:46:44 [D] [AVUPSUPAInvalid] : StatusCode [200] 04:46:44 [D] [AVUPSUPAInvalid] : Time [138] 04:46:44 [D] [AVUPSUPAInvalid] : Size [225] 04:46:44 [E] [AVUPSUPAInvalid] : Assertion [@StatusCode == 401 OR @StatusCode == 403] resolved-to [200 == 401 OR 200 == 403] result [Failed] IMPORTANT LINKS Vulnerability Details: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/recommendations/8a8081a4743534b601744fb6b75153cc/details Project: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/jobs Environment: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/environments/8a8081766fc3e2a1016fc421d7155a15/edit Scan Dashboard: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/jobs/8a8081766fc3e2a1016fc4230f426628/runs/8a8081a4743534b601744fb6866c5376 Playbook: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/template/ApiV1UsersPersonalSignUpPostAnonymousInvalid Coverage: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/configuration Code Sample: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/recommendations/8a8081a4743534b601744fb6b75153cc/codesamples PS: Please contact support@apisec.ai for apisec access and login issues. --- apisec Bot ---
intesar commented 4 years ago

Message : This issue is manually closed from FX control plane.

Title: Unsecured Vulnerability on POST:/api/v1/users/personal-sign-up Project: NetBanking API Description:

Assertion Name: Unsecured Endpoints ( 1 )

Overview: RESTful API is an application program interface (API) that uses HTTP requests to GET, PUT, POST, and DELETE data. A RESTful API — also referred to as a RESTful web service — is based on representational state transfer (REST) technology, an architectural style and approach to communications often used in web services development. These exposed endpoints should not be open to all and should be protected. A top priority for the organizations is to have Secured Endpoints.

The 'Unsecured Endpoint' scanning identifies vulnerabilities resulting from the non-protected endpoints. These endpoints requires no authentication scheme and are open for both authenticated and non-authenticated requests.

Authentication mechanisms are often implemented incorrectly, allowing attackers to compromise authentication tokens or to exploit implementation flaws to assume other user's identities temporarily or permanently. Compromising system's ability to identify the client/user, compromises API security overall.

Security misconfiguration is commonly a result of insecure default configurations, incomplete or ad-hoc configurations, open cloud storage, misconfigured HTTP headers, unnecessary HTTP methods, permissive Cross-Origin resource sharing (CORS), and verbose error messages containing sensitive information.

Severity: The difficulty of achieving API security has increased exponentially and unprotected APIs are one of the top web application security risks organizations face. OWASP included “Unprotected APIs” in its proposal for 2017 top 10 list. ( 2 )

Vulnerability Impact: Every exposed API end-point will have some action to be performed thru appropriate HTTP method and not all methods are valid for every single end-point. Left unchecked and opened for access to all, the following are some of the consequences ( 3 ).


Exploitation: Almost all kinds of authentication, injection, encryption, configuration, access control, and other issues can possible in the RESTful APIs as like the traditional application. Since APIs includes complex data structures and protocols, the security testing may become cumbersome for an attacker. But it is quite possible to analyze APIs and discover vulnerabilities and exploit ( 4 ).

Remediation: The following techniques may be utilized for having Secured Endpoints ( 3 ) ( 5 ) ( 6 ).

References:
  1. Representational State Transfer (REST) - https://en.wikipedia.org/wiki/Representational_state_transfer
  2. OWASP 2017 Top 10 Proposal –Unprotected APIs - https://www.owasp.org/index.php?title=Top_10_2017-A10-Underprotected_APIs&oldid=228947
  3. RESTful API Security - https://dzone.com/articles/restful-api-security
  4. API Exploits - https://www.hack2secure.com/blogs/what-are-api-exploits
  5. REST API Security Guidelines - https://dzone.com/articles/top-5-rest-api-security-guidelines
  6. OWASP REST Security Cheat Sheet - https://www.owasp.org/index.php/REST_Security_Cheat_Sheet

Risk: Unsecured Severity: Critical API Endpoint: http://95.217.118.53:8080/api/v1/users/personal-sign-up Environment: Master Playbook: ApiV1UsersPersonalSignUpPostAnonymousInvalid Researcher: QUICK TIPS Suggestion: Effort Estimate: Wire Logs: 04:46:44 [D] [AVUPSUPAInvalid] : URL [http://95.217.118.53:8080/api/v1/users/personal-sign-up] 04:46:44 [D] [AVUPSUPAInvalid] : Method [POST] 04:46:44 [D] [AVUPSUPAInvalid] : Auth [] 04:46:44 [D] [AVUPSUPAInvalid] : Request [{ "accountNonExpired" : false, "accountNonLocked" : false, "company" : "Hermann LLC", "createdBy" : "", "createdDate" : "", "credentialsNonExpired" : false, "email" : "maryjane.hamill@gmail.com", "enabled" : false, "id" : "", "inactive" : false, "jobTitle" : "Education Analyst", "location" : "Vi5rPKuG", "modifiedBy" : "", "modifiedDate" : "", "name" : "Vi5rPKuG", "password" : "9TVRZ2pCKKU_", "privileges" : [ "Vi5rPKuG" ], "username" : "evert.pouros", "version" : "" }] 04:46:44 [D] [AVUPSUPAInvalid] : Request-Headers [{Accept=[application/json], Content-Type=[application/json]}] 04:46:44 [D] [AVUPSUPAInvalid] : Response [{ "requestId" : "None", "requestTime" : "2020-09-02T16:46:44.731+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "Org name [Schulist, Schulist and Schulist] exists." } ], "data" : false, "totalPages" : 0, "totalElements" : 0 }] 04:46:44 [D] [AVUPSUPAInvalid] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 02 Sep 2020 16:46:43 GMT]}] 04:46:44 [D] [AVUPSUPAInvalid] : StatusCode [200] 04:46:44 [D] [AVUPSUPAInvalid] : Time [138] 04:46:44 [D] [AVUPSUPAInvalid] : Size [225] 04:46:44 [E] [AVUPSUPAInvalid] : Assertion [@StatusCode == 401 OR @StatusCode == 403] resolved-to [200 == 401 OR 200 == 403] result [Failed] IMPORTANT LINKS Vulnerability Details: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/recommendations/null/details Project: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/jobs Environment: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/environments/8a8081766fc3e2a1016fc421d7155a15/edit Scan Dashboard: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/jobs/8a8081766fc3e2a1016fc4230f426628/runs/8a8081a4743534b601744fb6866c5376 Playbook: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/template/ApiV1UsersPersonalSignUpPostAnonymousInvalid Coverage: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/configuration Code Sample: https://cloud.fxlabs.io/#/app/projects/8a8081766fc3e2a1016fc421d6e55a13/recommendations/null/codesamples PS: Please contact support@apisec.ai for apisec access and login issues. --- apisec Bot ---