@hoanghainh/komagu 2.5.0 → 2.6.0

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/findings/verified-6.json

@@ -0,0 +1,135 @@
+{
+  "batch_id": "verified-6",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0046-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "php-codeigniter/application/controllers/Invoice.php lines 20-23"
+      ],
+      "control_found": null,
+      "notes": "The code explicitly retrieves $id from POST input and uses it directly in an UPDATE query without any ownership verification against the session user. The class extends MY_Controller but no constructor logic or helper is shown that would enforce this check.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct usage of user-supplied ID in write operation without ownership binding."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/invoice/update",
+        "target_param": "invoice_id"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0047-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "php-laravel/app/Http/Controllers/AccountController.php lines 11-13"
+      ],
+      "control_found": null,
+      "notes": "The `register` method creates a new User directly from `$request->all()`. There is no check to ensure the authenticated user (if any) is authorized to create accounts, nor is there an ownership check on the created object. The code relies entirely on the framework's default behavior which allows creation if not explicitly restricted.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct instantiation of User model from request data without authorization check."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/account/register",
+        "target_param": "request"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0048-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "php-laravel/app/Http/Controllers/AccountController.php lines 16-18"
+      ],
+      "control_found": null,
+      "notes": "The `post` method creates a new Post directly from `$request->all()`. No ownership check or role-based access control is visible in the provided snippet. Any authenticated user could theoretically create posts.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct instantiation of Post model from request data without authorization check."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/account/post",
+        "target_param": "request"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0049-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "php-laravel/app/Http/Controllers/AccountController.php lines 21-23"
+      ],
+      "control_found": null,
+      "notes": "The `team` method creates a new Team directly from `$request->all()`. No ownership check or role-based access control is visible in the provided snippet. Any authenticated user could theoretically create teams.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct instantiation of Team model from request data without authorization check."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/account/team",
+        "target_param": "request"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0050-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "php-laravel/app/Http/Controllers/AccountController.php lines 26-30"
+      ],
+      "control_found": null,
+      "notes": "The `rename` method retrieves a user via `$request->user()` (which assumes the request contains valid auth headers) and then updates that specific user object using `$request->only(['name'])`. While it targets a specific user, there is no check to ensure the *current* authenticated user has permission to rename *that specific* user. An attacker could potentially manipulate the request to target another user if the `user()` method resolves based on a parameter or if the logic allows cross-user updates.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Update operation on a user object retrieved from request without verifying the current session user's authority to modify that specific target."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/account/rename",
+        "target_param": "request"
+      }
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/findings/verified-7.json

@@ -0,0 +1,87 @@
+{
+  "batch_id": "verified-7",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0051-1",
+      "verdict": "rejected",
+      "reason_code": "evidence_mismatch",
+      "confidence": "high",
+      "checked": [
+        "php-laravel/app/Http/Controllers/AccountController.php lines 33-37"
+      ],
+      "control_found": null,
+      "notes": "The finding references a file path 'php-laravel/app/Http/Controllers/AccountController.php'. However, the Auth Model explicitly states that the repository contains a 'polyglot legacy architecture' with Primary Web Layers of Classic ASP and Plain PHP. It notes: 'No ORM (Hibernate/JPA/Entity Framework) is detected in the primary security paths.' Laravel uses an ORM (Eloquent). The code context provided shows generic PHP syntax (`$request->user()`, `$user->fill()`), but the finding claims it is a Laravel application. Since the stack profile confirms no Laravel framework exists and the evidence points to Plain PHP, this finding relies on non-existent or misidentified code structure. The specific file path does not exist in the confirmed repository context.",
+      "suggested_subtype": "missing_ownership_check",
+      "suggested_cwe": [
+        "CWE-284"
+      ]
+    },
+    {
+      "finding_id": "BOLA-R-0043-verdict",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "perl-cgi/cgi-bin/order.cgi lines 1-20"
+      ],
+      "control_found": null,
+      "notes": "The code shows a Perl CGI script. Line 9 retrieves the user ID from the session (`$uid = $session->param('user_id');`). However, line 13 executes a query using `$id` (from request param) without binding it to `$uid`. While line 16 shows a prepared statement with binding (`? AND ?`), this is executed in a separate statement ($sth2) after the vulnerable one ($sth). The script proceeds to execute $sth regardless of whether $sth2 succeeds or fails. There is no `die`, `return`, or conditional check preventing execution of line 13 if line 16 fails. An attacker can manipulate `$id` in the first query to access another user's order before the ownership check on line 16 runs.",
+      "attack_vector": {
+        "method": "GET",
+        "path": "/perl-cgi/cgi-bin/order.cgi",
+        "target_param": "id"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0057-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/admin.php lines 7-8",
+        "php-plain/inc/auth.php"
+      ],
+      "control_found": null,
+      "notes": "The code in `admin.php` retrieves `$uid` from the GET parameter and uses it directly in a SQL query without checking if it matches the session user. The included `auth.php` only performs a login check (`if (empty($_SESSION['user_id']))`). It does not enforce ownership of the resource being accessed. This is a classic BOLA vulnerability where any authenticated user can view another user's profile by changing the `uid` parameter.",
+      "attack_vector": {
+        "method": "GET",
+        "path": "/php-plain/admin.php?action=view&uid=<user_id>",
+        "target_param": "uid"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0058-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/admin.php lines 11-12",
+        "php-plain/inc/auth.php"
+      ],
+      "control_found": null,
+      "notes": "Similar to finding BOLA-R-0057-1. The code retrieves `$id` from POST and executes a DELETE query without verifying ownership. The `auth.php` include only ensures the user is logged in, not that they own the target resource. An attacker can delete any user's account by manipulating the `id` parameter.",
+      "attack_vector": {
+        "method": "POST",
+        "path": "/php-plain/admin.php?action=delete&id=<user_id>",
+        "target_param": "id"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0061-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "confidence": "high",
+      "checked": [
+        "php-plain/order_detail.php lines 5-8",
+        "php-plain/inc/auth.php"
+      ],
+      "control_found": null,
+      "notes": "The code retrieves `$id` from GET and queries the `orders` table without filtering by the session user's ID. The included `auth.php` only checks for login status. There is no ownership verification before outputting the order details (address, items). This allows any authenticated user to read another user's order.",
+      "attack_vector": {
+        "method": "GET",
+        "path": "/php-plain/order_detail.php?id=<order_id>",
+        "target_param": "id"
+      }
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/findings/verified-8.json

@@ -0,0 +1,125 @@
+{
+  "batch_id": "verified-8",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0069-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "python-flask/app.py lines 8-13"
+      ],
+      "control_found": null,
+      "notes": "The endpoint `/orders/<int:order_id>` is protected by `@login_required` but the query `SELECT * FROM orders WHERE id = %s` uses the raw `order_id` parameter without verifying ownership against `current_user.id`. Unlike the `/orders/mine/` route, this path lacks an explicit ownership check.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct lookup by request id without tenant or user context binding."
+      },
+      "attack_vector": {
+        "method": "GET",
+        "path": "/orders/<int:order_id>",
+        "target_param": "order_id"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0071-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "python-flask/app.py lines 24-30"
+      ],
+      "control_found": null,
+      "notes": "The `/search` endpoint is protected by `@login_required`, but the query filters only by name (`WHERE name LIKE '%{q}%'`) and ignores ownership. An attacker can search for products owned by another user.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Search query lacks ownership scoping."
+      },
+      "attack_vector": {
+        "method": "GET|POST",
+        "path": "/search",
+        "target_param": "q"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0067-verdict",
+      "verdict": "rejected",
+      "reason_code": "control_found",
+      "severity": null,
+      "confidence": "high",
+      "checked": [
+        "php-plain/admin/promote.php lines 5-8"
+      ],
+      "control_found": {
+        "file": "php-plain/admin/promote.php",
+        "line": 5,
+        "code": "if ($_POST['is_admin'] == '1') {"
+      },
+      "notes": "The code explicitly checks `$_POST['is_admin']`. If this flag is present and set to '1', the user is granted admin privileges. While this relies on a specific POST parameter, it acts as an explicit authorization gate for the privilege escalation action described in the finding title (promoting to admin). The auditor's verdict was likely based on the lack of ownership check for the `uid`, but the finding implies a general vulnerability which is mitigated by this specific role-based control."
+    },
+    {
+      "finding_id": "BOLA-R-0072-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "python-flask/profile.py lines 8-13"
+      ],
+      "control_found": null,
+      "notes": "The `/users` POST endpoint creates a new user object directly from `request.json` (`User(**request.json)`) without verifying ownership or restricting fields. Any authenticated user can create accounts.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Mass assignment / IDOR on creation without ownership verification."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/users",
+        "target_param": "id"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0073-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "python-flask/profile.py lines 16-21"
+      ],
+      "control_found": null,
+      "notes": "The `/users/<int:uid>/name` endpoint fetches a user by ID (`User.query.get(uid)`) and updates the name without checking if `uid` belongs to the current user. This allows any authenticated user to modify another user's name.",
+      "consensus": {
+        "score": 0.95,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct modification of resource by ID without ownership check."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/users/<int:uid>/name",
+        "target_param": "uid"
+      }
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/findings/verified-9.json

@@ -0,0 +1,135 @@
+{
+  "batch_id": "verified-9",
+  "verifications": [
+    {
+      "finding_id": "BOLA-R-0074-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "python-flask/profile.py lines 24-30"
+      ],
+      "control_found": null,
+      "notes": "The code explicitly fetches the user by ID from the URL path (`User.query.get(uid)`) and then iterates over `request.json.items()` to set attributes on that object without any prior check comparing `uid` to the current session user's ID. The `[Bind]` attribute or similar validation is absent in this specific snippet, allowing arbitrary field updates.",
+      "consensus": {
+        "score": 1.0,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct lookup by request id without tenant or user context binding."
+      },
+      "attack_vector": {
+        "method": "PATCH",
+        "path": "/users/<int:uid>",
+        "target_param": "uid"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0010-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/CustomerController.cs lines 12-16"
+      ],
+      "control_found": null,
+      "notes": "The controller method `Edit` accepts a `Customer` object bound directly from the request. The code sets the entity state to `Modified` and saves it without verifying if the `customer.Id` matches the ID of the currently authenticated user. While `[Authorize]` is present on the class, it only ensures authentication, not ownership verification.",
+      "consensus": {
+        "score": 1.0,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Model binding accepts attacker-controlled ID; no ownership check before save."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/Customer/Edit",
+        "target_param": "customer.Id"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0011-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/CustomerController.cs lines 20-23"
+      ],
+      "control_found": null,
+      "notes": "The `EditName` method uses `[Bind(Include = \"Id,Name\")]`. This attribute allows the ID to be bound from the request. The code then calls `db.SaveChanges()` without checking if the bound `customer.Id` belongs to the current user. The allow-list restricts which fields are updated (only Id and Name), but it does not restrict *which* customer record is being updated.",
+      "consensus": {
+        "score": 1.0,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Allow-list restricts fields but not the target resource ID."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/Customer/EditName",
+        "target_param": "customer.Id"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0012-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Controllers/CustomerController.cs lines 27-32"
+      ],
+      "control_found": null,
+      "notes": "The `Refresh` method accepts an integer `id` parameter. It fetches the customer using `db.Customers.Find(id)` and then updates it via `TryUpdateModel`. There is no logic to verify that the `id` provided corresponds to the current user's record.",
+      "consensus": {
+        "score": 1.0,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct lookup by request id without tenant or user context binding."
+      },
+      "attack_vector": {
+        "method": "POST",
+        "path": "/Customer/Refresh",
+        "target_param": "id"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0016-1",
+      "verdict": "confirmed",
+      "reason_code": "traced",
+      "severity": "high",
+      "confidence": "high",
+      "checked": [
+        "dotnet-legacy/Web/Handlers/GetFile.ashx lines 8-10"
+      ],
+      "control_found": null,
+      "notes": "The handler retrieves `fileId` directly from the query string (`context.Request.QueryString[\"file_id\"]`) and passes it to `DocStore.PathFor(fileId)` which is then used for file transmission. There is no check to ensure the current user owns or has permission to access the file identified by this ID.",
+      "consensus": {
+        "score": 1.0,
+        "agreement_level": "unanimous",
+        "voted_models": [
+          "gemini-2.0-pro",
+          "claude-3-7"
+        ],
+        "rationale": "Direct lookup by request id without tenant or user context binding."
+      },
+      "attack_vector": {
+        "method": "GET",
+        "path": "/dotnet-legacy/Web/Handlers/GetFile.ashx",
+        "target_param": "file_id"
+      }
+    }
+  ]
+}