jaleelsyed / rbac

0 stars 0 forks source link

RBAC testing : ApiV1EnvsPostRolePmDisallowedRbac #160

Closed jaleelsyed closed 5 years ago

jaleelsyed commented 5 years ago

Project : RBAC testing

Job : Default

Env : Default

Category : RBAC

Tags : [OWASP - OTG-IDENT-001 , FX Top 10 - API Vulnerability]

Severity : Major

Region : local

Result : fail

Status Code : 500

Headers : {}

Endpoint : http://localhost:8090/api/v1/envs

Request :

Response :
I/O error on POST request for "http://localhost:8090/api/v1/envs": Connect to localhost:8090 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused: connect; nested exception is org.apache.http.conn.HttpHostConnectException: Connect to localhost:8090 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused: connect

Logs :
2019-01-21 06:55:21 DEBUG [ApiV1EnvsPostRolePmDisallowedRbac] : URL [http://localhost:8090/api/v1/envs] 2019-01-21 06:55:21 DEBUG [ApiV1EnvsPostRolePmDisallowedRbac] : Method [POST] 2019-01-21 06:55:21 DEBUG [ApiV1EnvsPostRolePmDisallowedRbac] : Request [] 2019-01-21 06:55:21 DEBUG [ApiV1EnvsPostRolePmDisallowedRbac] : Request-Headers [{Content-Type=[application/json], Accept=[application/json]}] 2019-01-21 06:55:21 DEBUG [ApiV1EnvsPostRolePmDisallowedRbac] : Response [I/O error on POST request for "http://localhost:8090/api/v1/envs": Connect to localhost:8090 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused: connect; nested exception is org.apache.http.conn.HttpHostConnectException: Connect to localhost:8090 [localhost/127.0.0.1, localhost/0:0:0:0:0:0:0:1] failed: Connection refused: connect] 2019-01-21 06:55:21 DEBUG [ApiV1EnvsPostRolePmDisallowedRbac] : Response-Headers [{}] 2019-01-21 06:55:21 DEBUG [ApiV1EnvsPostRolePmDisallowedRbac] : StatusCode [500] 2019-01-21 06:55:21 DEBUG [ApiV1EnvsPostRolePmDisallowedRbac] : Time [2220] 2019-01-21 06:55:21 DEBUG [ApiV1EnvsPostRolePmDisallowedRbac] : Size [356] 2019-01-21 06:55:21 ERROR [ApiV1EnvsPostRolePmDisallowedRbac] : Assertion [@StatusCode == 401 OR @StatusCode == 403] resolved-to [500 == 401 OR 500 == 403] result [Failed]

--- FX Bot ---