@hoanghainh/komagu 2.5.0 → 2.6.0

package/assess/lsa/examples/eval-run-6/qwen-16k-partial/findings/bola-routes-004.json

@@ -0,0 +1,463 @@
+{
+  "batch_id": "routes-004",
+  "findings": [
+    {
+      "finding_id": "BOLA-R-0057-1",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "User view endpoint allows any authenticated user to view another user's record via uid parameter",
+      "route_id": "R-0057",
+      "endpoint": {
+        "method": "GET|POST",
+        "path": "/php-plain/admin.php?action=view"
+      },
+      "location": {
+        "file": "php-plain/admin.php",
+        "start_line": 6,
+        "end_line": 8
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin.php",
+          "line": 7,
+          "code": "$uid = (int)$_GET['uid'];",
+          "why": "ID from query string"
+        },
+        {
+          "file": "php-plain/admin.php",
+          "line": 8,
+          "code": "SELECT * FROM users WHERE id = $uid;",
+          "why": "No user_id ownership check in WHERE clause"
+        }
+      ],
+      "attack_scenario": "User A sends GET /admin.php?action=view&uid=<user id of user B> and receives B's user record.",
+      "impact": "Read other users' personal data (name, email, role).",
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Add AND user_id = :session_user_id to the query or load the record then compare owner and return 404 on mismatch.",
+      "status": "unverified",
+      "attack_vector": {
+        "target_param": "uid"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0058-1",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "User delete endpoint allows any authenticated user to delete another user's record via id parameter",
+      "route_id": "R-0058",
+      "endpoint": {
+        "method": "GET|POST",
+        "path": "/php-plain/admin.php?action=delete"
+      },
+      "location": {
+        "file": "php-plain/admin.php",
+        "start_line": 10,
+        "end_line": 12
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin.php",
+          "line": 11,
+          "code": "$id = $_POST['id'];",
+          "why": "ID from POST body"
+        },
+        {
+          "file": "php-plain/admin.php",
+          "line": 12,
+          "code": "DELETE FROM users WHERE id = $id;",
+          "why": "No user_id ownership check in WHERE clause"
+        }
+      ],
+      "attack_scenario": "User A sends POST /admin.php?action=delete&id=<user id of user B> and deletes B's account.",
+      "impact": "Delete other users' accounts (account takeover, data loss).",
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Add AND user_id = :session_user_id to the query or load the record then compare owner and return 404 on mismatch.",
+      "status": "unverified",
+      "attack_vector": {
+        "target_param": "uid"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0066-1",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "User delete endpoint allows any authenticated user to delete another user's record via id parameter",
+      "route_id": "R-0066",
+      "endpoint": {
+        "method": "POST",
+        "path": "/php-plain/admin/delete_user.php"
+      },
+      "location": {
+        "file": "php-plain/admin/delete_user.php",
+        "start_line": 5,
+        "end_line": 7
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin/delete_user.php",
+          "line": 5,
+          "code": "$id = (int)$_POST['id'];",
+          "why": "ID from POST body"
+        },
+        {
+          "file": "php-plain/admin/delete_user.php",
+          "line": 6,
+          "code": "DELETE FROM users WHERE id = ?;",
+          "why": "No user_id ownership check in WHERE clause"
+        }
+      ],
+      "attack_scenario": "User A sends POST /admin/delete_user.php?id=<user id of user B> and deletes B's account.",
+      "impact": "Delete other users' accounts (account takeover, data loss).",
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Add AND user_id = :session_user_id to the query or load the record then compare owner and return 404 on mismatch.",
+      "status": "unverified",
+      "attack_vector": {
+        "target_param": "id"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0067-1",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "User promote endpoint allows any authenticated user to promote another user to admin via uid parameter",
+      "route_id": "R-0067",
+      "endpoint": {
+        "method": "POST",
+        "path": "/php-plain/admin/promote.php"
+      },
+      "location": {
+        "file": "php-plain/admin/promote.php",
+        "start_line": 5,
+        "end_line": 7
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin/promote.php",
+          "line": 6,
+          "code": "$stmt = $db->prepare(\"UPDATE users SET role = 'admin' WHERE id = ?\");",
+          "why": "No user_id ownership check in WHERE clause"
+        },
+        {
+          "file": "php-plain/admin/promote.php",
+          "line": 7,
+          "code": "$stmt->execute(array((int)$_POST['uid']));",
+          "why": "ID from POST body used directly"
+        }
+      ],
+      "attack_scenario": "User A sends POST /admin/promote.php with uid=<user id of user B> and promotes B to admin.",
+      "impact": "Elevate privileges for other users (privilege escalation).",
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Add AND user_id = :session_user_id to the query or load the record then compare owner and return 404 on mismatch.",
+      "status": "unverified",
+      "attack_vector": {
+        "target_param": "uid"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0059-1",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "User delete endpoint allows any authenticated user to delete another user's record via id parameter",
+      "route_id": "R-0059",
+      "endpoint": {
+        "method": "POST",
+        "path": "/php-plain/manage_users.php"
+      },
+      "location": {
+        "file": "php-plain/manage_users.php",
+        "start_line": 6,
+        "end_line": 7
+      },
+      "evidence": [
+        {
+          "file": "php-plain/manage_users.php",
+          "line": 6,
+          "code": "$stmt = $db->prepare(\"DELETE FROM users WHERE id = ?\");",
+          "why": "No user_id ownership check in WHERE clause"
+        },
+        {
+          "file": "php-plain/manage_users.php",
+          "line": 7,
+          "code": "$stmt->execute(array($_POST['id']));",
+          "why": "ID from POST body used directly"
+        }
+      ],
+      "attack_scenario": "User A sends POST /manage_users.php?id=<user id of user B> and deletes B's account.",
+      "impact": "Delete other users' accounts (account takeover, data loss).",
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Add AND user_id = :session_user_id to the query or load the record then compare owner and return 404 on mismatch.",
+      "status": "unverified",
+      "attack_vector": {
+        "target_param": "id"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0061-1",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "Order detail endpoint allows any authenticated user to view another user's order via id parameter",
+      "route_id": "R-0061",
+      "endpoint": {
+        "method": "GET",
+        "path": "/php-plain/order_detail.php"
+      },
+      "location": {
+        "file": "php-plain/order_detail.php",
+        "start_line": 5,
+        "end_line": 8
+      },
+      "evidence": [
+        {
+          "file": "php-plain/order_detail.php",
+          "line": 5,
+          "code": "$id = $_GET['id'];",
+          "why": "ID from query string"
+        },
+        {
+          "file": "php-plain/order_detail.php",
+          "line": 6,
+          "code": "SELECT * FROM orders WHERE id = $id;",
+          "why": "No user_id ownership check in WHERE clause"
+        }
+      ],
+      "attack_scenario": "User A sends GET /order_detail.php?id=<order id of user B> and receives B's order details.",
+      "impact": "Read other customers' orders (name, address, amount).",
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Add AND user_id = :session_user_id to the query or load the order then compare owner and return 404 on mismatch.",
+      "status": "unverified",
+      "attack_vector": {
+        "target_param": "id"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0069-1",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "Order detail endpoint allows any authenticated user to view another user's order via order_id parameter",
+      "route_id": "R-0069",
+      "endpoint": {
+        "method": "GET",
+        "path": "/orders/<int:order_id>"
+      },
+      "location": {
+        "file": "python-flask/app.py",
+        "start_line": 11,
+        "end_line": 13
+      },
+      "evidence": [
+        {
+          "file": "python-flask/app.py",
+          "line": 11,
+          "code": "def order(order_id):",
+          "why": "order_id from URL path"
+        },
+        {
+          "file": "python-flask/app.py",
+          "line": 12,
+          "code": "cur.execute(\"SELECT * FROM orders WHERE id = %s\" % order_id)",
+          "why": "No user_id ownership check in WHERE clause"
+        }
+      ],
+      "attack_scenario": "User A sends GET /orders/<order id of user B> and receives B's order details.",
+      "impact": "Read other customers' orders (name, address, amount).",
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-284",
+        "CWE-639"
+      ],
+      "recommendation": "Add AND user_id = :session_user_id to the query or load the order then compare owner and return 404 on mismatch.",
+      "status": "unverified",
+      "attack_vector": {
+        "target_param": "order_id"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0055-verdict",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "Missing ownership check at php-laravel/routes/web.php:9 (from auditor verdict)",
+      "route_id": "R-0055",
+      "location": {
+        "file": "php-laravel/routes/web.php",
+        "start_line": 9
+      },
+      "evidence": [
+        {
+          "file": "php-laravel/routes/web.php",
+          "line": 9,
+          "why": "The auditor judged this route 'needs_review' but wrote no finding"
+        }
+      ],
+      "impact": "Generated from the auditor's 'needs_review' verdict; the model wrote no finding for it.",
+      "severity": "medium",
+      "confidence": "low",
+      "cwe": [
+        "CWE-284"
+      ],
+      "recommendation": "Bind the object lookup to the current user or tenant, or check ownership before using it.",
+      "status": "unverified",
+      "endpoint": {
+        "method": "POST",
+        "path": "/account/rename"
+      },
+      "attack_vector": {
+        "target_param": "id"
+      }
+    },
+    {
+      "finding_id": "BOLA-R-0056-verdict",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "Missing ownership check at php-laravel/routes/web.php:10 (from auditor verdict)",
+      "route_id": "R-0056",
+      "location": {
+        "file": "php-laravel/routes/web.php",
+        "start_line": 10
+      },
+      "evidence": [
+        {
+          "file": "php-laravel/routes/web.php",
+          "line": 10,
+          "why": "The auditor judged this route 'needs_review' but wrote no finding"
+        }
+      ],
+      "impact": "Generated from the auditor's 'needs_review' verdict; the model wrote no finding for it.",
+      "severity": "medium",
+      "confidence": "low",
+      "cwe": [
+        "CWE-284"
+      ],
+      "recommendation": "Bind the object lookup to the current user or tenant, or check ownership before using it.",
+      "status": "unverified",
+      "endpoint": {
+        "method": "POST",
+        "path": "/account/profile"
+      },
+      "attack_vector": {
+        "target_param": "id"
+      }
+    }
+  ],
+  "route_verdicts": [
+    {
+      "route_id": "R-0052",
+      "verdict": "safe",
+      "reason": "POST /register creates new user data; no object identifier is manipulated to access existing owned resources"
+    },
+    {
+      "route_id": "R-0053",
+      "verdict": "safe",
+      "reason": "POST /posts creates new post data; no object identifier is manipulated to access existing owned resources"
+    },
+    {
+      "route_id": "R-0054",
+      "verdict": "safe",
+      "reason": "POST /teams creates new team data; no object identifier is manipulated to access existing owned resources"
+    },
+    {
+      "route_id": "R-0055",
+      "verdict": "needs_review",
+      "reason": "Laravel route definition only; controller implementation not visible to verify ownership check"
+    },
+    {
+      "route_id": "R-0056",
+      "verdict": "needs_review",
+      "reason": "Laravel route definition only; controller implementation not visible to verify ownership check"
+    },
+    {
+      "route_id": "R-0057",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "BOLA-R-0057-1"
+      ]
+    },
+    {
+      "route_id": "R-0058",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "BOLA-R-0058-1"
+      ]
+    },
+    {
+      "route_id": "R-0059",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "BOLA-R-0059-1"
+      ]
+    },
+    {
+      "route_id": "R-0061",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "BOLA-R-0061-1"
+      ]
+    },
+    {
+      "route_id": "R-0062",
+      "verdict": "safe",
+      "reason": "query binds user_id = $_SESSION['user_id'] at line 5 with AND user_id = ?"
+    },
+    {
+      "route_id": "R-0066",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "BOLA-R-0066-1"
+      ]
+    },
+    {
+      "route_id": "R-0067",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "BOLA-R-0067-1"
+      ]
+    },
+    {
+      "route_id": "R-0069",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "BOLA-R-0069-1"
+      ]
+    },
+    {
+      "route_id": "R-0070",
+      "verdict": "safe",
+      "reason": "query binds user_id = current_user.id at line 20 with AND user_id = %s"
+    },
+    {
+      "route_id": "R-0071",
+      "verdict": "safe",
+      "reason": "search endpoint queries products table which is not user-owned data; no object identifier manipulation"
+    }
+  ]
+}

package/assess/lsa/examples/eval-run-6/qwen-16k-partial/findings/bola-routes-005.json

@@ -0,0 +1,5 @@
+{
+  "batch_id": "routes-005",
+  "findings": [],
+  "route_verdicts": []
+}

package/assess/lsa/examples/eval-run-6/qwen-16k-partial/findings/bola-routes-006.json

@@ -0,0 +1,67 @@
+{
+  "batch_id": "routes-006",
+  "findings": [
+    {
+      "finding_id": "BOLA-R-0065-1",
+      "category": "bola",
+      "subtype": "missing_ownership_check",
+      "title": "Product search returns all products without user ownership verification",
+      "route_id": "R-0065",
+      "endpoint": {
+        "method": "GET",
+        "path": "/php-plain/search.php"
+      },
+      "location": {
+        "file": "php-plain/search.php",
+        "start_line": 7,
+        "end_line": 15
+      },
+      "evidence": [
+        {
+          "file": "php-plain/search.php",
+          "line": 7,
+          "code": "$sql = \"SELECT id, name FROM products WHERE 1=1\";",
+          "why": "Query starts without user_id filter"
+        },
+        {
+          "file": "php-plain/search.php",
+          "line": 8,
+          "code": "$sql .= \" AND name LIKE '%\" . $kw . \"%'\";",
+          "why": "Only filters by search term, no ownership check"
+        },
+        {
+          "file": "php-plain/search.php",
+          "line": 14,
+          "code": "WHERE category = '{$_GET['cat']}'",
+          "why": "Category filter only, no user_id or owner binding"
+        }
+      ],
+      "attack_scenario": "Authenticated User A sends GET /search.php?q=widget&cat=electronics with another user's product ID in results and receives products they don't own.",
+      "impact": "Read other customers' product data (names, categories, potentially prices if returned).",
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-639"
+      ],
+      "owasp": [
+        "API1:2023"
+      ],
+      "recommendation": "Add AND user_id = :current_user_id to all product queries, or load products then compare owner and return 404 on mismatch",
+      "status": "unverified"
+    }
+  ],
+  "route_verdicts": [
+    {
+      "route_id": "R-0064",
+      "verdict": "not_applicable",
+      "reason": "Registration endpoint creates new user records; no object identifier to manipulate for accessing another user's existing data"
+    },
+    {
+      "route_id": "R-0065",
+      "verdict": "vulnerable",
+      "finding_ids": [
+        "BOLA-R-0065-1"
+      ]
+    }
+  ]
+}