@hoanghainh/komagu 1.8.0 → 2.0.1

package/assess/lsa/examples/eval-run-4/iter2-gptoss-a/findings/priv-privilege-001.json

@@ -0,0 +1,540 @@
+{
+  "batch_id": "privilege-001",
+  "findings": [
+    {
+      "finding_id": "BFLA-R-0003-1",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Unrestricted member deletion in classic\u2011ASP",
+      "route_id": "R-0003",
+      "location": {
+        "file": "classic-asp/shop/member.asp",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "classic-asp/shop/member.asp",
+          "line": 10,
+          "why": "DELETE FROM members WHERE member_id = ... (privileged action, no role check)"
+        },
+        {
+          "file": "classic-asp/shop/member.asp",
+          "line": 9,
+          "why": "no role check before the delete"
+        }
+      ],
+      "impact": "Any authenticated user can delete any member record.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "recommendation": "Add a server\u2011side check that the current user has admin privileges before executing the delete.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "BFLA-R-0007-1",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Unauthenticated user can delete any user in ASP.NET MVC",
+      "route_id": "R-0007",
+      "location": {
+        "file": "Web/Controllers/AdminController.cs",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "Web/Controllers/AdminController.cs",
+          "line": 14,
+          "why": "db.Users.Remove(u); (privileged action, no role check)"
+        },
+        {
+          "file": "Web/Controllers/AdminController.cs",
+          "line": 12,
+          "why": "no [Authorize(Roles=\"Admin\")] on DeleteUser"
+        }
+      ],
+      "impact": "Any authenticated user can delete any account.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "recommendation": "Add [Authorize(Roles=\"Admin\")] to DeleteUser or enforce role check in code.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "BFLA-R-0009-1",
+      "category": "bfla",
+      "subtype": "role_from_request",
+      "title": "Export endpoint controlled by request parameter in ASP.NET MVC",
+      "route_id": "R-0009",
+      "location": {
+        "file": "Web/Controllers/AdminController.cs",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "Web/Controllers/AdminController.cs",
+          "line": 32,
+          "why": "if (Request.QueryString[\"isAdmin\"] == \"true\") return Json(db.Users.ToList());"
+        },
+        {
+          "file": "Web/Controllers/AdminController.cs",
+          "line": 30,
+          "why": "no role check before the export"
+        }
+      ],
+      "impact": "Any authenticated user can export all user data by setting isAdmin=true.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-269",
+        "CWE-285"
+      ],
+      "recommendation": "Validate the caller's role server\u2011side before returning the data.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "BFLA-R-0023-1",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Unprotected user deletion in Spring MVC",
+      "route_id": "R-0023",
+      "location": {
+        "file": "com/acme/web/AdminUserController.java",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "com/acme/web/AdminUserController.java",
+          "line": 15,
+          "why": "userDao.deleteById(id); (privileged action, no role check)"
+        },
+        {
+          "file": "com/acme/web/AdminUserController.java",
+          "line": 13,
+          "why": "no @PreAuthorize on delete method"
+        }
+      ],
+      "impact": "Any authenticated user can delete any user.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "recommendation": "Add @PreAuthorize(\"hasRole('ADMIN')\") to the delete method.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "BFLA-R-0030-1",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Unprotected user deletion in Express.js",
+      "route_id": "R-0030",
+      "location": {
+        "file": "routes.js",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "routes.js",
+          "line": 9,
+          "why": "User.deleteOne({ _id: req.params.id }) (privileged action, no admin check)"
+        },
+        {
+          "file": "routes.js",
+          "line": 8,
+          "why": "ensureLoggedIn only, no requireAdmin"
+        }
+      ],
+      "impact": "Any authenticated user can delete any user.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "recommendation": "Add a server\u2011side admin check before the delete operation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "BFLA-R-0032-1",
+      "category": "bfla",
+      "subtype": "role_from_request",
+      "title": "Export endpoint controlled by query param in Express.js",
+      "route_id": "R-0032",
+      "location": {
+        "file": "routes.js",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "routes.js",
+          "line": 17,
+          "why": "res.json([]) when req.query.isAdmin === 'true' (privileged action, no role check)"
+        },
+        {
+          "file": "routes.js",
+          "line": 16,
+          "why": "ensureLoggedIn only, no admin check"
+        }
+      ],
+      "impact": "Any authenticated user can export all users by setting isAdmin=true.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-269",
+        "CWE-285"
+      ],
+      "recommendation": "Validate the caller's role server\u2011side before returning data.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "BFLA-R-0057-1",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Unprotected user view in PHP plain",
+      "route_id": "R-0057",
+      "location": {
+        "file": "php-plain/admin.php",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin.php",
+          "line": 8,
+          "why": "SELECT * FROM users WHERE id = ... (privileged action, no role check)"
+        },
+        {
+          "file": "php-plain/admin.php",
+          "line": 6,
+          "why": "no role check before the query"
+        }
+      ],
+      "impact": "Any authenticated user can view any user record.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "recommendation": "Add a server\u2011side admin check before executing the query.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "BFLA-R-0058-1",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Unprotected user deletion in PHP plain",
+      "route_id": "R-0058",
+      "location": {
+        "file": "php-plain/admin.php",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin.php",
+          "line": 12,
+          "why": "DELETE FROM users WHERE id = $id (privileged action, no role check)"
+        },
+        {
+          "file": "php-plain/admin.php",
+          "line": 10,
+          "why": "no role check before the delete"
+        }
+      ],
+      "impact": "Any authenticated user can delete any user.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "recommendation": "Add a server\u2011side admin check before executing the delete.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "BFLA-R-0066-1",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Unprotected user deletion in PHP plain",
+      "route_id": "R-0066",
+      "location": {
+        "file": "php-plain/admin/delete_user.php",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin/delete_user.php",
+          "line": 6,
+          "why": "DELETE FROM users WHERE id = ? (privileged action, no role check)"
+        },
+        {
+          "file": "php-plain/admin/delete_user.php",
+          "line": 1,
+          "why": "no role check before the delete"
+        }
+      ],
+      "impact": "Any authenticated user can delete any user.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "recommendation": "Add a server\u2011side admin check before executing the delete.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "BFLA-R-0067-1",
+      "category": "bfla",
+      "subtype": "role_from_request",
+      "title": "Privilege escalation via role promotion in PHP plain",
+      "route_id": "R-0067",
+      "location": {
+        "file": "php-plain/admin/promote.php",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin/promote.php",
+          "line": 6,
+          "why": "UPDATE users SET role = 'admin' WHERE id = ... (privileged action, no role check)"
+        },
+        {
+          "file": "php-plain/admin/promote.php",
+          "line": 5,
+          "why": "role set from $_POST['is_admin'] (client\u2011side control)"
+        },
+        {
+          "file": "php-plain/admin/promote.php",
+          "line": 1,
+          "why": "no role check before the update"
+        }
+      ],
+      "impact": "Any authenticated user can promote themselves to admin.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-269",
+        "CWE-285"
+      ],
+      "recommendation": "Validate the caller's role server\u2011side before allowing role changes.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "BFLA-R-0059-1",
+      "category": "bfla",
+      "subtype": "client_side_role_check",
+      "title": "Client\u2011side role check only in PHP plain",
+      "route_id": "R-0059",
+      "location": {
+        "file": "php-plain/manage_users.php",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "php-plain/manage_users.php",
+          "line": 6,
+          "why": "DELETE FROM users WHERE id = ? (privileged action, no server\u2011side role check)"
+        },
+        {
+          "file": "php-plain/manage_users.php",
+          "line": 11,
+          "why": "role check only in HTML output, not in code"
+        }
+      ],
+      "impact": "Any authenticated user can delete any user.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-602",
+        "CWE-285"
+      ],
+      "recommendation": "Add a server\u2011side admin check before executing the delete.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "BFLA-R-0063-1",
+      "category": "bfla",
+      "subtype": "role_from_request",
+      "title": "Privilege escalation via role field in PHP plain profile update",
+      "route_id": "R-0063",
+      "location": {
+        "file": "php-plain/profile.php",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "php-plain/profile.php",
+          "line": 6,
+          "why": "foreach ($_POST as $field => $value) { $user->$field = $value; } (whole object binding)"
+        },
+        {
+          "file": "php-plain/profile.php",
+          "line": 10,
+          "why": "$user->role = $_POST['role']; (privileged field)"
+        },
+        {
+          "file": "php-plain/profile.php",
+          "line": 11,
+          "why": "save_user($user); (writes role to DB)"
+        }
+      ],
+      "impact": "Any authenticated user can change their role to admin.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915",
+        "CWE-269"
+      ],
+      "recommendation": "Restrict binding to non\u2011privileged fields or set privileged fields server\u2011side.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0011-1",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Unrestricted binding of all POST fields to User in PHP plain",
+      "candidate_id": "M-0011",
+      "location": {
+        "file": "php-plain/profile.php",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "php-plain/profile.php",
+          "line": 6,
+          "why": "foreach ($_POST as $field => $value) { $user->$field = $value; } (binds all fields)"
+        },
+        {
+          "file": "php-plain/profile.php",
+          "line": 10,
+          "why": "$user->role = $_POST['role']; (privileged field)"
+        },
+        {
+          "file": "php-plain/profile.php",
+          "line": 11,
+          "why": "save_user($user); (writes role to DB)"
+        }
+      ],
+      "impact": "role field can be set by the caller.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Restrict binding to allowed fields or set privileged fields server\u2011side.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0012-1",
+      "category": "mass_assignment",
+      "subtype": "privileged_field_writable",
+      "title": "Privilege escalation via role field in PHP plain",
+      "candidate_id": "M-0012",
+      "location": {
+        "file": "php-plain/profile.php",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "php-plain/profile.php",
+          "line": 10,
+          "why": "$user->role = $_POST['role']; (privileged field)"
+        },
+        {
+          "file": "php-plain/profile.php",
+          "line": 11,
+          "why": "save_user($user); (writes role to DB)"
+        }
+      ],
+      "impact": "role field can be set by the caller.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915",
+        "CWE-269"
+      ],
+      "recommendation": "Restrict binding to allowed fields or set privileged fields server\u2011side.",
+      "status": "unverified"
+    }
+  ],
+  "privilege_route_verdicts": [
+    {
+      "route_id": "R-0003",
+      "verdict": "vulnerable"
+    },
+    {
+      "route_id": "R-0007",
+      "verdict": "vulnerable"
+    },
+    {
+      "route_id": "R-0009",
+      "verdict": "vulnerable"
+    },
+    {
+      "route_id": "R-0023",
+      "verdict": "vulnerable"
+    },
+    {
+      "route_id": "R-0030",
+      "verdict": "vulnerable"
+    },
+    {
+      "route_id": "R-0032",
+      "verdict": "vulnerable"
+    },
+    {
+      "route_id": "R-0057",
+      "verdict": "vulnerable"
+    },
+    {
+      "route_id": "R-0058",
+      "verdict": "vulnerable"
+    },
+    {
+      "route_id": "R-0066",
+      "verdict": "vulnerable"
+    },
+    {
+      "route_id": "R-0067",
+      "verdict": "vulnerable"
+    },
+    {
+      "route_id": "R-0059",
+      "verdict": "vulnerable"
+    },
+    {
+      "route_id": "R-0063",
+      "verdict": "vulnerable"
+    }
+  ],
+  "candidate_verdicts": [
+    {
+      "candidate_id": "M-0011",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "M-0012",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "M-0001",
+      "verdict": "safe"
+    },
+    {
+      "candidate_id": "M-0002",
+      "verdict": "safe"
+    },
+    {
+      "candidate_id": "M-0003",
+      "verdict": "safe"
+    },
+    {
+      "candidate_id": "M-0004",
+      "verdict": "safe"
+    },
+    {
+      "candidate_id": "M-0005",
+      "verdict": "safe"
+    }
+  ]
+}