Unsecured on GET:/api/v1/primary-transaction/{id} #96
Description
Title: Unsecured Vulnerability on GET:/api/v1/primary-transaction/{id}
Project: SanityGitHub0306
Description: The unsecured exploit gives an attacker full access to the vulnerable endpoint without credentials.
Risk: Unsecured
Severity: Major
API Endpoint: http://138.91.64.62:8080/api/v1/primary-transaction/yBJtDLeR
Environment: Master
Playbook: ApiV1PrimaryTransactionIdGetAnonymousInvalid
Researcher: [apisec Bot]
QUICK TIPS
Suggestion: Make sure the endpoint is secured as part of the authentication framework.
Effort Estimate: 2.0
Wire Logs:
08:44:06 [D] [AVPTIGAInvalid] : URL [http://138.91.64.62:8080/api/v1/primary-transaction/yBJtDLeR]
08:44:06 [D] [AVPTIGAInvalid] : Method [GET]
08:44:06 [D] [AVPTIGAInvalid] : Auth []
08:44:06 [D] [AVPTIGAInvalid] : Request []
08:44:06 [D] [AVPTIGAInvalid] : Request-Headers [{Content-Type=[application/json], Accept=[application/json]}]
08:44:06 [D] [AVPTIGAInvalid] : Response [{
"requestId" : "None",
"requestTime" : "2020-06-03T08:44:06.094+0000",
"errors" : true,
"messages" : [ {
"type" : "ERROR",
"key" : "",
"value" : null
} ],
"data" : null,
"totalPages" : 0,
"totalElements" : 0
}]
08:44:06 [D] [AVPTIGAInvalid] : Response-Headers [{X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Content-Type=[application/json;charset=UTF-8], Transfer-Encoding=[chunked], Date=[Wed, 03 Jun 2020 08:44:05 GMT]}]
08:44:06 [D] [AVPTIGAInvalid] : StatusCode [200]
08:44:06 [D] [AVPTIGAInvalid] : Time [9]
08:44:06 [D] [AVPTIGAInvalid] : Size [176]
08:44:06 [E] [AVPTIGAInvalid] : Assertion [@statuscode == 401 OR @statuscode == 403] resolved-to [200 == 401 OR 200 == 403] result [Failed]
IMPORTANT LINKS
Vulnerability Details:
https://cloud.fxlabs.io/#/app/projects/8a8081397278f8ba01727922a45a0593/recommendations/8a8081397278f8ba0172795acc8b2437/details
Project:
https://cloud.fxlabs.io/#/app/projects/8a8081397278f8ba01727922a45a0593/jobs
Coverage:
https://cloud.fxlabs.io/#/app/projects/8a8081397278f8ba01727922a45a0593/configuration
PS: Please contact support@apisec.ai for apisec access and login issues.
--- apisec Bot ---