You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
/user/files/download/unverified - file parameter (below steps to validate this vulnerability)
1. Go to Home Page
2. Login as `[email protected]`, password as `password`
3. Enter `12345` as the OTP
4. Click `Download Files` menu from the user home page.
5. Enter `c:\\windows\\system.ini` and `Submit`.
6. Browser will prompt to keep or discard the `system.ini` file which is being downloaded
7. Let us try another method to re-run the same exploit.
8. Open new browser tab
9. Enter `http://localhost:8080//user/files/download/unverified?file=../../../../../../windows/system.ini`
10. Browser will prompt to keep or discard the `system.ini` file which is being downloaded
11. Any `*secret and sensitive files*` can be downloaded using this exploit.
A03:2021 Injection - SQL Injection
/Products - search textbox ( below Steps to validate this vulnerability)
1. Go to Home Page
2. Login as `[email protected]`, password as `password`
3. Enter `12345` as the OTP
3. Hover on the username on the right top of the screen next to Search glass icon.
4. Note that the drop-down menu contains Home, API Explorer and Logout
5. Click on the SHOP menu
6. List of available products will be displayed
5. In the search textbox, enter **'; INSERT INTO user_authorities (authority_id, user_id) VALUES ('05970e74-c82b-4e21-b100-f8184d6e3454', '32e7db01-86bc-4687-9ecb-d79b265ac14f') -- **
6. Click search icon
7. A message such as `Searching for: '; INSERT INTO user_authorities (authority_id, user_id) VALUES ('05970e74-c82b-4e21-b100-f8184d6e3454', '32e7db01-86bc-4687-9ecb-d79b265ac14f') --` will be shown.
6. Log Out from existing session
7. Login again with above user credentials
8. repeat steps 3.
9. Now, the username dropdown on the right top of the screen will show: `Site Administration` and `Database Console` apart from the three menu items shown earlier
10. user1 has become an admin and can do anything - including adding products, canceling orders, removing users etc.
A03:2021 Injection - Cross site scripting (Reflected)
/products/xss - search textbox ( below Steps to validate this vulnerability)
1. Go to Home Page
2. Go to SHOP -> Health & Well being -> First Aid menu
3. In the search textbox, enter **<i><script>alert("hi")</script></i>**
4. Click search
5. Script in the search-term gets executed and exposes the vulnerability
A04:2021-Insecure Design
/user/log - val parameter (below steps to validate this vulnerability)
1. Go to Home Page
2. Click on SHOP
3. In the search textbox, enter *test'*
4. Click search
5. An error page with full stacktrace is shown. Stacktrace shows the entire SQL command used exposing sensitive information like column and table names.
A05:2021 Security Misconfiguration - XML External Entity (XXE)
/user/files/upload-xml - File Content textarea (below Steps to validate this vulnerability)
1. Go to Home Page
2. Login as `[email protected]`, password as `password`
3. Enter 12345 as the OTP
4. Click `Upload XML Files` menu from the user home page.
5. Upload any xml file by clicking on `Choose File` and `Submit`.
4. Once you file uploaded successfully, you will be able to see the `file` and its `content`.
5. Replace the content with `<!--?xml version="1.0" ?--><!DOCTYPE replace[<!ENTITY example "Doe"> ]><userInfo><firstName>John</firstName><lastName>&example;</lastName></userInfo>`
6. click on the `Save` link below the content box. This should reflect the executed xml with last name as "Doe"
7. Let's try another payload.
8. Follow Steps 3-5 using different xml file.
9. Replace content with **<?xml version="1.0" encoding="utf-8"?><!DOCTYPE order[ <!ENTITY myExternalEntity SYSTEM "file:///C:/Windows/System32/drivers/etc/hosts">]><order>&myExternalEntity;</order>**
10. Now the server hosts file will be shown as the content of updated xml file.
A06:2021-Vulnerable and Outdated Components (Composition only)
/user/command-shell - Command text field (below Steps to validate this vulnerability)
1. Go to Home Page
2. Login as `[email protected]`, password as `password`
3. Enter 12345 as the OTP
4. Click `Command Shell` menu from the user home page.
5. Enter `cmd /c echo "calc.exe" > C:\\a06-vul-java.bat & C:\\a06-vul-java.bat` in the `Windows Command To Execute` text box.
6. **`a06-vul-java.bat` file will exist, ran successfully and Calc application is opened.**
A08:2021 – Software and Data Integrity Failures
/cart/order - CVE-2020-36518 jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.
A09:2021-Security Logging and Monitoring Failures (log forging/static)
/products - keywords parameter (below steps to validate this vulnerability)
1. Go to Home Page
2. Login as `[email protected]`, password as `password`
3. Enter `12345` as the OTP
4. Click `Log Entry` menu from the user home page.
5. Enter `17` as the first line
6. Enter `2022-08-09 02:46:04.136 INFO 2654 --- [nio-8080-exec-3] c.m.e.w.c.UserController : Order payment reversed successfully for user1` as the second line.
7. Click `Submit`.
8. In the web application console (cmd window), `Order payment reversed successfully for user1` would have got logged in a separate line as a valid log entry.
A10:2021 Server-Side Request Forgery
/user/ssrf - url parameter (below steps to validate this vulnerability)
1. Go to Home Page
2. Login as `[email protected]`, password as `password`
3. Enter `12345` as the OTP
4. Click `Load URL` menu from the user home page.
5. Enter `file:///windows/system.ini` and `Submit`.
6. Contents of `C:\windows\system.ini` will be displayed in the `URL Content` area.