Title: XSS_Injection Vulnerability on PUT:/api/v1/issues/ui
Project: Bismillah
Description:
Assertion
Name: XSS Injection ( 1 )
Overview: Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.
Looking forward to generic implementations, developers tend to expose all object properties without considering their individual sensitivity, relying on clients to perform the data filtering before displaying it to the user.
Security misconfiguration is commonly a result of insecure default configurations, incomplete or ad-hoc configurations, open cloud storage, misconfigured HTTP headers, unnecessary HTTP methods, permissive Cross-Origin resource sharing (CORS), and verbose error messages containing sensitive information.
Severity: Cross-Site Scripting is consistently ranked at top 1 in 2017 OWASP Top 10, 2013 OWASP Top 10 and is ranked at Top 8 in 2019 OWASP API Top 10. ( 2 )( 3 )( 4 ).
Vulnerability Impact: When successfully injected and executed, XSS attack can lead to following consequences ( 1 )
Capturing sensitive information viewed by application users
Hijacking another user’s browser session and takeover of the account
The disclosure of end user files and/or installation of Trojan horse programs
Pseudo defacement of the application
Port scanning of internal hosts (“internal” in relation to the users of the web application)
Data enters a Web application through an untrusted source, most frequently a web request.
The data is included in dynamic content that is sent to a web user without being validated for malicious content.
The malicious content sent to the web browser often takes the form of a segment of JavaScript, but may also include HTML, Flash, or any other type of code that the browser may execute
Remediation: With the following guidelines, XSS Injection attack can be prevented ( 5 ).
Never Insert Untrusted Data Except in Allowed Locations
HTML Escape Before Inserting Untrusted Data into HTML Element Content
Attribute Escape Before Inserting Untrusted Data into HTML Common Attributes
JavaScript Escape Before Inserting Untrusted Data into JavaScript Data Values
CSS Escape And Strictly Validate Before Inserting Untrusted Data into HTML Style Property Values
URL Escape Before Inserting Untrusted Data into HTML URL Parameter Values
Title: XSS_Injection Vulnerability on PUT:/api/v1/issues/ui Project: Bismillah Description:
Assertion Name: XSS Injection ( 1 )
Overview: Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.
Looking forward to generic implementations, developers tend to expose all object properties without considering their individual sensitivity, relying on clients to perform the data filtering before displaying it to the user.
Security misconfiguration is commonly a result of insecure default configurations, incomplete or ad-hoc configurations, open cloud storage, misconfigured HTTP headers, unnecessary HTTP methods, permissive Cross-Origin resource sharing (CORS), and verbose error messages containing sensitive information.
Severity: Cross-Site Scripting is consistently ranked at top 1 in 2017 OWASP Top 10, 2013 OWASP Top 10 and is ranked at Top 8 in 2019 OWASP API Top 10. ( 2 )( 3 )( 4 ).
Vulnerability Impact: When successfully injected and executed, XSS attack can lead to following consequences ( 1 )
The malicious content sent to the web browser often takes the form of a segment of JavaScript, but may also include HTML, Flash, or any other type of code that the browser may execute
Remediation: With the following guidelines, XSS Injection attack can be prevented ( 5 ).
Risk: XSS_Injection Severity: Medium API Endpoint: http://netbanking.apisec.ai:8080/api/v1/issues/ui Environment: Master_github Playbook: ApiV1IssuesUiPutBodyParamXssInjection Researcher: [apisec Bot]
QUICK TIPS
Suggestion: Effort Estimate: 4.0 Hrs Wire Logs: 07:21:32 [D] [AVIUPBPXInjection] : Endpoint [http://netbanking.apisec.ai:8080/api/v1/issues/ui] 07:21:32 [D] [AVIUPBPXInjection] : Method [PUT] 07:21:32 [D] [AVIUPBPXInjection] : Authorization [Default] 07:21:32 [D] [AVIUPBPXInjection] : Request headers [[Accept:"application/json", Content-Type:"application/json", Authorization=[**]]] 07:21:32 [D] [AVIUPBPXInjection] : Request [{ "assertions" : "", "assignedTo" : "", "createdBy" : "", "createdDate" : "", "description" : "", "endpoint" : "", "env" : "", "failedAssertions" : "", "headers" : [ "1del5hJI" ], "id" : "", "inactive" : false, "issueName" : "", "issueStatus" : "CLOSED", "issueType" : "AUTOMATIC", "method" : "HEAD", "modifiedBy" : "", "modifiedDate" : "", "project" : { "createdBy" : "", "createdDate" : "", "description" : "", "id" : "", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "name" : "", "org" : { "createdBy" : "", "createdDate" : "", "id" : "", "inactive" : false, "modifiedBy" : "", "modifiedDate" : "", "name" : "", "version" : "" }, "refId" : "", "version" : "" }, "requestBody" : "", "responseBody" : "", "responseHeaders" : "", "result" : "", "statusCode" : "", "tags" : [ "1del5hJI" ], "version" : "" }] 07:21:32 [D] [AVIUPBPXInjection] : Status code [200] 07:21:32 [D] [AVIUPBPXInjection] : Response headers [[X-Content-Type-Options:"nosniff", X-XSS-Protection:"1; mode=block", Cache-Control:"no-cache, no-store, max-age=0, must-revalidate", Pragma:"no-cache", Expires:"0", X-Frame-Options:"DENY", Set-Cookie:"SESSION=ZDZlMzczMmQtOGE4NC00ZjQ0LTlmZDUtZjcxNWNkZGE4ZGE5; Path=/; HttpOnly", Content-Type:"application/json;charset=UTF-8", Transfer-Encoding:"chunked", Date:"Thu, 26 May 2022 07:21:32 GMT"]] 07:21:32 [D] [AVIUPBPXInjection] : Response [{ "requestId" : "None", "requestTime" : "2022-05-26T07:21:32.262+0000", "errors" : true, "messages" : [ { "type" : "ERROR", "key" : "", "value" : "could not extract ResultSet; SQL [n/a]; nested exception is org.hibernate.exception.SQLGrammarException: could not extract ResultSet" } ], "data" : null, "totalPages" : 0, "totalElements" : 0 }] 07:21:32 [D] [AVIUPBPXInjection] : Response time [641] 07:21:32 [D] [AVIUPBPXInjection] : Response size [306] 07:21:32 [E] [AVIUPBPXInjection] : Assertion [@StatusCode != 200] resolved-to [200 != 200] result [Failed] 07:21:32 [D] [AVIUPBPXInjection] : Endpoint [http://netbanking.apisec.ai:8080/api/v1/issues/ui] 07:21:32 [D] [AVIUPBPXInjection] : Method [PUT] 07:21:32 [D] [AVIUPBPXInjection] : Authorization [Default] 07:21:32 [D] [AVIUPBPXInjection] : Request headers [[Accept:"application/json", Content-Type:"application/json", Authorization=[**]]] 07:21:32 [D] [AVIUPBPXInjection] : Request [{ "assertions" : "
IMPORTANT LINKS
Vulnerability Details: https://20.120.71.252/#/app/projects/8a70803680faf14f0180ff0340040534/dashboard/8a70808e80faf1570180ff3e0a134a8f/details
Project: https://20.120.71.252/#/app/projects/8a70803680faf14f0180ff0340040534/allScans
Environment: https://20.120.71.252/#/app/projects/8a70803680faf14f0180ff0340040534/environments/8a70803680faf14f0180ff39a86e480c/edit
Scan Dashboard: https://20.120.71.252/#/app/projects/8a70803680faf14f0180ff0340040534/profiles/8a70803680faf14f0180ff39a883480e/runs/8a70803680faf14f0180ff3c15334811
Playbook: https://20.120.71.252/#/app/projects/8a70803680faf14f0180ff0340040534/playbooks/ApiV1IssuesUiPutBodyParamXssInjection
Coverage: https://20.120.71.252/#/app/projects/8a70803680faf14f0180ff0340040534/categories
Code Sample: https://20.120.71.252/#/app/projects/8a70803680faf14f0180ff0340040534/dashboard/8a70808e80faf1570180ff3e0a134a8f/codesamples
PS: Please contact support@apisec.ai for apisec access and login issues.
--- apisec Bot ---