Unsecured on POST:/api/v1/users/team-sign-up

[asriz7777]

Title: Unsecured Vulnerability on POST:/api/v1/users/team-sign-up
Project: SanityFX3JUN
Description: The unsecured exploit gives an attacker full access to the vulnerable endpoint without credentials.
Risk: Unsecured
Severity: Major
API Endpoint: http://138.91.64.62:8080/api/v1/users/team-sign-up
Environment: Master_copy
Playbook: ApiV1UsersTeamSignUpPostAnonymousInvalid
Researcher: [apisec Bot]

QUICK TIPS

Suggestion: Make sure the endpoint is secured as part of the authentication framework.
Effort Estimate: 2.0
Wire Logs:
10:12:29 [D] [AVUTSUPAInvalid] : URL [http://138.91.64.62:8080/api/v1/users/team-sign-up]
10:12:29 [D] [AVUTSUPAInvalid] : Method [POST]
10:12:29 [D] [AVUTSUPAInvalid] : Auth []
10:12:29 [D] [AVUTSUPAInvalid] : Request [{
"accountNonExpired" : false,
"accountNonLocked" : false,
"company" : "Feil and Sons",
"createdBy" : "",
"createdDate" : "",
"credentialsNonExpired" : false,
"email" : "ford.gutmann@hotmail.com",
"enabled" : false,
"id" : "",
"inactive" : false,
"jobTitle" : "Education Supervisor",
"location" : "yrFh9eMh",
"modifiedBy" : "",
"modifiedDate" : "",
"name" : "yrFh9eMh",
"password" : "BWQjKuMCJJA!",
"privileges" : [ "yrFh9eMh" ],
"username" : "dakota.hilpert",
"version" : ""
}]
10:12:29 [D] [AVUTSUPAInvalid] : Request-Headers [{Content-Type=[application/json], Accept=[application/json]}]
10:12:29 [D] [AVUTSUPAInvalid] : Response [{
"requestId" : "None",
"requestTime" : "2020-06-03T10:12:29.819+0000",
"errors" : true,
"messages" : [ {
"type" : "ERROR",
"key" : "",
"value" : "Org name [Kessler, Kessler and Kessler] exists."
} ],
"data" : false,
"totalPages" : 0,
"totalElements" : 0
}]
10:12:29 [D] [AVUTSUPAInvalid] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 03 Jun 2020 10:12:29 GMT]}]
10:12:29 [D] [AVUTSUPAInvalid] : StatusCode [200]
10:12:29 [D] [AVUTSUPAInvalid] : Time [858]
10:12:29 [D] [AVUTSUPAInvalid] : Size [222]
10:12:29 [E] [AVUTSUPAInvalid] : Assertion [@statuscode == 401 OR @statuscode == 403] resolved-to [200 == 401 OR 200 == 403] result [Failed]

IMPORTANT LINKS

Vulnerability Details:
https://cloud.fxlabs.io/#/app/projects/8a8081397278f8ba0172794cc22c1e71/recommendations/8a8081397278f8ba017279b3b2923c9b/details

Project:
https://cloud.fxlabs.io/#/app/projects/8a8081397278f8ba0172794cc22c1e71/jobs

Environment:
https://cloud.fxlabs.io/#/app/projects/8a8081397278f8ba0172794cc22c1e71/environments/8a8081397278f8ba01727973d14328c7/edit

Scan Dashboard:
https://cloud.fxlabs.io/#/app/projects/8a8081397278f8ba0172794cc22c1e71/jobs/8a8081397278f8ba01727973d15e28c9/runs/8a8081397278f8ba017279aae49839b7

Playbook:
https://cloud.fxlabs.io/#/app/projects/8a8081397278f8ba0172794cc22c1e71/template/ApiV1UsersTeamSignUpPostAnonymousInvalid

Coverage:
https://cloud.fxlabs.io/#/app/projects/8a8081397278f8ba0172794cc22c1e71/configuration

Code Sample:
https://cloud.fxlabs.io/#/app/projects/8a8081397278f8ba0172794cc22c1e71/recommendations/8a8081397278f8ba017279b3b2923c9b/codesamples

PS: Please contact support@apisec.ai for apisec access and login issues.

--- apisec Bot ---