@hoanghainh/komagu 2.4.0 → 2.6.0

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/findings/priv-privilege-002.json

@@ -0,0 +1,306 @@
+{
+  "batch_id": "privilege-002",
+  "findings": [
+    {
+      "finding_id": "MASS-M-0008-1",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "User registration binds the entire request body to the User model without field restrictions",
+      "route_id": null,
+      "candidate_id": "M-0008",
+      "location": {
+        "file": "php-laravel/app/Http/Controllers/AccountController.php",
+        "start_line": 13
+      },
+      "evidence": [
+        {
+          "file": "php-laravel/app/Http/Controllers/AccountController.php",
+          "line": 13,
+          "code": "return User::create($request->all());",
+          "why": "Binds all request fields to the User model. Model definition shows $guarded = [], meaning no fields are protected."
+        },
+        {
+          "file": "php-laravel/app/Models/User.php",
+          "line": 8,
+          "code": "protected $guarded = [];",
+          "why": "Model allows writing to all fields, including sensitive ones like role or owner_id."
+        }
+      ],
+      "impact": "An attacker can set any field (e.g., role='admin', owner_id=1) during registration.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915"
+      ],
+      "owasp": [
+        "API3:2023",
+        "A01:2021"
+      ],
+      "recommendation": "Define a whitelist of allowed fields (e.g., $fillable = ['name', 'email']) in the User model.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0009-1",
+      "category": "mass_assignment",
+      "subtype": "privileged_field_writable",
+      "title": "Team creation allows writing to the owner_id field via request body",
+      "route_id": null,
+      "candidate_id": "M-0009",
+      "location": {
+        "file": "php-laravel/app/Http/Controllers/AccountController.php",
+        "start_line": 23
+      },
+      "evidence": [
+        {
+          "file": "php-laravel/app/Http/Controllers/AccountController.php",
+          "line": 23,
+          "code": "return Team::create($request->all());",
+          "why": "Binds all request fields to the Team model. Model definition explicitly lists 'owner_id' as fillable."
+        },
+        {
+          "file": "php-laravel/app/Models/Team.php",
+          "line": 8,
+          "code": "protected $fillable = ['name', 'owner_id'];",
+          "why": "The owner_id field is explicitly allowed to be written from the request."
+        }
+      ],
+      "impact": "An attacker can set the owner_id of a new team to an arbitrary user ID, hijacking ownership.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915",
+        "CWE-269"
+      ],
+      "owasp": [
+        "API3:2023",
+        "A01:2021"
+      ],
+      "recommendation": "Remove 'owner_id' from the $fillable array in the Team model and set it server-side based on the authenticated user.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0013-1",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "User creation via extract() binds all POST parameters to the database insert",
+      "route_id": null,
+      "candidate_id": "M-0013",
+      "location": {
+        "file": "php-plain/register.php",
+        "start_line": 4
+      },
+      "evidence": [
+        {
+          "file": "php-plain/register.php",
+          "line": 4,
+          "why": "Location taken from the Tier 1 inventory"
+        }
+      ],
+      "impact": "An attacker can set the 'role' field in the POST body to escalate privileges (e.g., role='admin').",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915"
+      ],
+      "owasp": [
+        "API3:2023",
+        "A01:2021"
+      ],
+      "recommendation": "Do not use extract() on user input. Explicitly map only required fields (email, name) to the statement parameters.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0014-1",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "User creation via **kwargs binds all JSON fields to the User model",
+      "route_id": null,
+      "candidate_id": "M-0014",
+      "location": {
+        "file": "python-flask/profile.py",
+        "start_line": 10
+      },
+      "evidence": [
+        {
+          "file": "python-flask/profile.py",
+          "line": 10,
+          "why": "Location taken from the Tier 1 inventory"
+        }
+      ],
+      "impact": "An attacker can set any field (e.g., role='admin', is_verified=True) during user creation.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915"
+      ],
+      "owasp": [
+        "API3:2023",
+        "A01:2021"
+      ],
+      "recommendation": "Explicitly pass only allowed fields to the User constructor or use a DTO with validation.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0015-1",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "User update via loop binds all JSON fields to the User model",
+      "route_id": null,
+      "candidate_id": "M-0015",
+      "location": {
+        "file": "python-flask/profile.py",
+        "start_line": 27
+      },
+      "evidence": [
+        {
+          "file": "python-flask/profile.py",
+          "line": 27,
+          "why": "Location taken from the Tier 1 inventory"
+        }
+      ],
+      "impact": "An attacker can modify any attribute of an existing user (e.g., role='admin', owner_id=1).",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915"
+      ],
+      "owasp": [
+        "API3:2023",
+        "A01:2021"
+      ],
+      "recommendation": "Restrict the loop to a whitelist of allowed fields (e.g., name, email) before updating.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0006-verdict",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Mass assignment at node-express/routes/profile.js:8 (from auditor verdict)",
+      "candidate_id": "M-0006",
+      "location": {
+        "file": "node-express/routes/profile.js",
+        "start_line": 8
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/profile.js",
+          "line": 8,
+          "why": "The auditor judged this candidate 'needs_review' but wrote no finding"
+        }
+      ],
+      "impact": "Generated from the auditor's 'needs_review' verdict; the model wrote no finding for it.",
+      "severity": "medium",
+      "confidence": "low",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Bind only an explicit allow-list of fields; never bind role, owner or balance fields.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0007-verdict",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Mass assignment at node-express/routes/profile.js:16 (from auditor verdict)",
+      "candidate_id": "M-0007",
+      "location": {
+        "file": "node-express/routes/profile.js",
+        "start_line": 16
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/profile.js",
+          "line": 16,
+          "why": "The auditor judged this candidate 'needs_review' but wrote no finding"
+        }
+      ],
+      "impact": "Generated from the auditor's 'needs_review' verdict; the model wrote no finding for it.",
+      "severity": "medium",
+      "confidence": "low",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Bind only an explicit allow-list of fields; never bind role, owner or balance fields.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0010-verdict",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Mass assignment at php-laravel/app/Http/Controllers/AccountController.php:36 (from auditor verdict)",
+      "candidate_id": "M-0010",
+      "location": {
+        "file": "php-laravel/app/Http/Controllers/AccountController.php",
+        "start_line": 36
+      },
+      "evidence": [
+        {
+          "file": "php-laravel/app/Http/Controllers/AccountController.php",
+          "line": 36,
+          "why": "The auditor judged this candidate 'needs_review' but wrote no finding"
+        }
+      ],
+      "impact": "Generated from the auditor's 'needs_review' verdict; the model wrote no finding for it.",
+      "severity": "medium",
+      "confidence": "low",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Bind only an explicit allow-list of fields; never bind role, owner or balance fields.",
+      "status": "unverified"
+    }
+  ],
+  "privilege_route_verdicts": [],
+  "candidate_verdicts": [
+    {
+      "candidate_id": "M-0006",
+      "verdict": "needs_review",
+      "reason": "Model definition not found; cannot verify if sensitive fields like role or owner are writable."
+    },
+    {
+      "candidate_id": "M-0007",
+      "verdict": "needs_review",
+      "reason": "Model definition not found; cannot verify if sensitive fields like role or owner are writable."
+    },
+    {
+      "candidate_id": "M-0008",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "MASS-M-0008-1"
+      ]
+    },
+    {
+      "candidate_id": "M-0009",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "MASS-M-0009-1"
+      ]
+    },
+    {
+      "candidate_id": "M-0010",
+      "verdict": "needs_review",
+      "reason": "Model definition not found; cannot verify if sensitive fields like role or owner are writable."
+    },
+    {
+      "candidate_id": "M-0013",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "MASS-M-0013-1"
+      ]
+    },
+    {
+      "candidate_id": "M-0014",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "MASS-M-0014-1"
+      ]
+    },
+    {
+      "candidate_id": "M-0015",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "MASS-M-0015-1"
+      ]
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/findings/verified-1.json

@@ -0,0 +1,137 @@
+{
+  "batch_id": "verified-1",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0002-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "classic-asp/shop/member.asp lines 6-7",
+        "inc/auth.asp logic"
+      ],
+      "control_found": null,
+      "notes": "The UPDATE query uses `member_id` directly from `Request.Form`. The included `auth.asp` only checks if a session exists (`Session(\"UserID\") = \"\"`), it does not verify that the current user owns the target record. No ownership check is present in the SQL construction.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct ID injection into UPDATE without ownership verification."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/classic-asp/shop/member.asp?mode=edit",
+        "target_param": "member_id"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0003-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "classic-asp/shop/member.asp line 10",
+        "inc/auth.asp logic"
+      ],
+      "control_found": null,
+      "notes": "The DELETE query uses `member_id` directly from `Request.QueryString`. The included `auth.asp` only checks if a session exists. No ownership check is present in the SQL construction.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct ID injection into DELETE without ownership verification."
+      },
+      "attack_vector": {
+        "method": "GET",
+        "path": "/classic-asp/shop/member.asp?mode=delete&member_id=<id>",
+        "target_param": "member_id"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0005-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "OrderService.cfc lines 3-6"
+      ],
+      "control_found": null,
+      "notes": "The `getOrder` function accepts `orderId` as a string argument and uses it directly in the SQL query (`WHERE id = #arguments.orderId#`). There is no logic to retrieve the current user's ID or filter by ownership. The `access=\"remote\"` attribute confirms this is exposed.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct ID injection into SELECT without ownership verification."
+      },
+      "attack_vector": {
+        "method": "GET",
+        "path": "/coldfusion/app/OrderService.cfc?method=getOrder&orderId=<id>",
+        "target_param": "orderId"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0007-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "AdminController.cs lines 12-15"
+      ],
+      "control_found": null,
+      "notes": "The `DeleteUser` method has `[Authorize]` (ensuring the caller is authenticated) but lacks any role restriction like `[Authorize(Roles = \"Admin\")]`. It takes an integer `id` and deletes the user found by that ID without checking if the current user owns it or has admin privileges. A standard authenticated user could delete another user.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Authenticated but unprivileged user can delete any record via ID injection."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/Admin/DeleteUser?id=<id>",
+        "target_param": "id"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0008-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "AdminController.cs lines 21-25"
+      ],
+      "control_found": null,
+      "notes": "The `ResetPassword` method has `[Authorize(Roles = \"Admin\")]`. While this restricts access to admins, it does not prevent an Admin from resetting *another* Admin's (or any other user's) password. The finding correctly identifies that ownership verification is missing. An attacker with Admin privileges can reset any user's password.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Role-based access control (RBAC) is present but insufficient for ownership protection; ID injection allows privilege escalation within the role."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/Admin/ResetPassword?id=<id>",
+        "target_param": "id"
+      }
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/findings/verified-10.json

@@ -0,0 +1,106 @@
+{
+  "batch_id": "verified-10",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0029-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "ProfileServlet.java lines 10-16",
+        "BeanUtils.populate usage"
+      ],
+      "control_found": null,
+      "notes": "The code uses BeanUtils.populate which blindly maps all request parameters to the object fields. There is no visible ownership check (e.g., verifying `account.id` against session user) before any persistence logic in the provided snippet. The finding is valid.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct population of object from request without ID verification."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/profile/update (inferred)",
+        "target_param": "id"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0039-1",
+      "verdict": "rejected",
+      "reason_code": "control_found",
+      "severity": null,
+      "confidence": "high",
+      "checked": [
+        "node-express/routes/profile.js line 8"
+      ],
+      "control_found": {
+        "file": "node-express/routes/profile.js",
+        "line": 8,
+        "code": "User.findByIdAndUpdate(req.user._id, req.body, ...)"
+      },
+      "notes": "The query explicitly uses `req.user._id` (server-side identity) as the lookup key. Even if an attacker sends a different ID in the body, it is ignored for the lookup. This prevents unauthorized access to other users' profiles."
+    },
+    {
+      "finding_id": "BOLA-R-0040-1",
+      "verdict": "rejected",
+      "reason_code": "control_found",
+      "severity": null,
+      "confidence": "high",
+      "checked": [
+        "node-express/routes/profile.js line 12"
+      ],
+      "control_found": {
+        "file": "node-express/routes/profile.js",
+        "line": 12,
+        "code": "User.findByIdAndUpdate(req.user._id, { name: req.body.name }, ...)"
+      },
+      "notes": "The query explicitly uses `req.user._id` as the lookup key. The ID from the request body is not used for resource identification, preventing IDOR."
+    },
+    {
+      "finding_id": "BOLA-R-0041-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "node-express/routes/profile.js lines 15-18"
+      ],
+      "control_found": null,
+      "notes": "The `/signup` route handler does not include the `ensureLoggedIn` middleware. While this is primarily an authentication bypass (CWE-306) rather than a BOLA, it confirms the finding that the endpoint accepts requests without verifying authentication status. The finding title mentions 'no_authentication', which aligns with the code.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Missing authentication middleware on signup endpoint."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/signup",
+        "target_param": null
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0042-1",
+      "verdict": "rejected",
+      "reason_code": "control_found",
+      "severity": null,
+      "confidence": "high",
+      "checked": [
+        "node-express/routes/profile.js line 21"
+      ],
+      "control_found": {
+        "file": "node-express/routes/profile.js",
+        "line": 21,
+        "code": "var prefs = Object.assign({}, req.user.prefs, { theme: req.body.theme });"
+      },
+      "notes": "The code constructs the response object using `req.user.prefs` (server-side identity). It does not use any ID from the request to fetch or modify data. The finding claims 'IDOR if ID is passed', but no ID parameter is used in the logic, making the claim false."
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/findings/verified-11.json

@@ -0,0 +1,81 @@
+{
+  "batch_id": "verified-11",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0063-1",
+      "verdict": "rejected",
+      "reason_code": "control_found",
+      "confidence": "high",
+      "checked": [
+        "php-plain/profile.php lines 5-11",
+        "php-plain/inc/auth.php"
+      ],
+      "control_found": {
+        "file": "php-plain/profile.php",
+        "line": 5,
+        "code": "$user = load_user($_SESSION['uid']);"
+      },
+      "notes": "The code explicitly loads the user object using `$_SESSION['uid']` (server-side identity) before modifying it. The subsequent loop modifies properties on this specific `$user` object instance. Since the object is fetched by the authenticated user's ID, the modification is scoped to that user. This is a safe pattern for self-modification.",
+      "suggested_subtype": null,
+      "suggested_cwe": null
+    },
+    {
+      "finding_id": "BOLA-R-0068-1",
+      "verdict": "rejected",
+      "reason_code": "control_found",
+      "confidence": "high",
+      "checked": [
+        "php-plain/admin/settings.php lines 5-10",
+        "php-plain/inc/auth.php"
+      ],
+      "control_found": {
+        "file": "php-plain/admin/settings.php",
+        "line": 5,
+        "code": "if ($_SESSION['role'] !== 'admin') { ... exit; }"
+      },
+      "notes": "The code explicitly checks if the session role is 'admin' and exits if it is not. This prevents non-admin users from accessing or modifying global settings. The control is visible in the provided context.",
+      "suggested_subtype": null,
+      "suggested_cwe": null
+    },
+    {
+      "finding_id": "BOLA-R-0060-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/mongo_find.php lines 5-6",
+        "php-plain/inc/auth.php"
+      ],
+      "control_found": null,
+      "notes": "The code uses `$_GET['login']` and `$_GET['pass']` directly in the MongoDB query without verifying if the currently authenticated user owns the returned document. The auth check in `inc/auth.php` only ensures a user is logged in, not that they own the data being queried. This allows any authenticated user to look up another user's credentials.",
+      "suggested_subtype": null,
+      "suggested_cwe": null
+    },
+    {
+      "finding_id": "INJ-I-0001",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "classic-asp/shop/member.asp lines 6-8"
+      ],
+      "control_found": null,
+      "notes": "The code constructs an SQL query by concatenating `Request.Form(\"name\")` directly into the string. There is no parameter binding, integer casting, or allow-list validation visible in the provided context. This is a classic SQL Injection vector.",
+      "suggested_subtype": null,
+      "suggested_cwe": null
+    },
+    {
+      "finding_id": "INJ-I-0002",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "classic-asp/shop/member.asp lines 7-8"
+      ],
+      "control_found": null,
+      "notes": "The code constructs an SQL query by concatenating `Request.Form(\"member_id\")` directly into the string. There is no parameter binding or integer casting visible in the provided context. This is a classic SQL Injection vector.",
+      "suggested_subtype": null,
+      "suggested_cwe": null
+    }
+  ]
+}