@hoanghainh/komagu 2.5.0 → 2.6.1

package/assess/lsa/examples/eval-run-6/qwen-16k-nothink/findings/priv-privilege-001.json

@@ -0,0 +1,726 @@
+{
+  "batch_id": "privilege-001",
+  "findings": [
+    {
+      "finding_id": "BFLA-R-0003-1",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Any authenticated user can delete members",
+      "route_id": "R-0003",
+      "endpoint": {
+        "method": "ANY",
+        "path": "/classic-asp/shop/member.asp?mode=delete"
+      },
+      "location": {
+        "file": "classic-asp/shop/member.asp",
+        "start_line": 9,
+        "end_line": 10
+      },
+      "evidence": [
+        {
+          "file": "classic-asp/shop/member.asp",
+          "line": 2,
+          "code": "<!--#include file=\"inc/auth.asp\"-->",
+          "why": "Includes auth check which only verifies login (Session(\"UserID\") exists), not role"
+        },
+        {
+          "file": "classic-asp/shop/member.asp",
+          "line": 10,
+          "code": "conn.Execute \"DELETE FROM members WHERE member_id = \" & Request.QueryString(\"member_id\")",
+          "why": "Privileged deletion action executed without verifying admin role"
+        }
+      ],
+      "impact": "Any authenticated user can delete other users.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "owasp": [
+        "API5:2023",
+        "A01:2021"
+      ],
+      "recommendation": "Add a server-side role check in the ASP page before executing the delete logic.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "BFLA-R-0009-1",
+      "category": "bfla",
+      "subtype": "role_from_request",
+      "title": "Admin role is determined by request parameter instead of server-side check",
+      "route_id": "R-0009",
+      "endpoint": {
+        "method": "POST",
+        "path": "/Admin/Export"
+      },
+      "location": {
+        "file": "dotnet-legacy/Web/Controllers/AdminController.cs",
+        "start_line": 32,
+        "end_line": 34
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Controllers/AdminController.cs",
+          "line": 32,
+          "code": "if (Request.QueryString[\"isAdmin\"] == \"true\")",
+          "why": "Role/permission is derived directly from client input"
+        }
+      ],
+      "impact": "Any authenticated user can export all users by setting isAdmin=true.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "owasp": [
+        "API5:2023",
+        "A01:2021"
+      ],
+      "recommendation": "Verify the user's role from the authenticated identity object before executing the export.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "BFLA-R-0023-1",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Any authenticated user can delete users via REST endpoint",
+      "route_id": "R-0023",
+      "endpoint": {
+        "method": "POST",
+        "path": "/admin/users/{id}/delete"
+      },
+      "location": {
+        "file": "java-legacy/src/com/acme/web/AdminUserController.java",
+        "start_line": 13,
+        "end_line": 16
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/web/AdminUserController.java",
+          "line": 7,
+          "code": "@Controller",
+          "why": "No class-level security annotation found"
+        },
+        {
+          "file": "java-legacy/src/com/acme/web/AdminUserController.java",
+          "line": 13,
+          "code": "@RequestMapping(value = \"/{id}/delete\", method = RequestMethod.POST)",
+          "why": "Privileged delete action lacks specific role check"
+        },
+        {
+          "file": "java-legacy/src/com/acme/web/AdminUserController.java",
+          "line": 15,
+          "code": "userDao.deleteById(id);",
+          "why": "Execution proceeds without verifying admin role"
+        }
+      ],
+      "impact": "Any authenticated user can delete other users.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "owasp": [
+        "API5:2023",
+        "A01:2021"
+      ],
+      "recommendation": "Add @PreAuthorize(\"hasRole('ADMIN')\") or equivalent check before the delete logic.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "BFLA-R-0057-1",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Any authenticated user can view admin users",
+      "route_id": "R-0057",
+      "endpoint": {
+        "method": "GET|POST",
+        "path": "/php-plain/admin.php?action=view"
+      },
+      "location": {
+        "file": "php-plain/admin.php",
+        "start_line": 6,
+        "end_line": 9
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin.php",
+          "line": 2,
+          "code": "require_once 'inc/auth.php';",
+          "why": "Includes auth check which only verifies login"
+        },
+        {
+          "file": "php-plain/admin.php",
+          "line": 8,
+          "code": "$r = mysql_query(\"SELECT * FROM users WHERE id = \" . $uid);",
+          "why": "Privileged read action executed without verifying admin role"
+        }
+      ],
+      "impact": "Any authenticated user can view other users' data.",
+      "severity": "high",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "owasp": [
+        "API5:2023",
+        "A01:2021"
+      ],
+      "recommendation": "Add a server-side role check in the PHP file before executing the query.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "BFLA-R-0058-1",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Any authenticated user can delete users via GET/POST",
+      "route_id": "R-0058",
+      "endpoint": {
+        "method": "GET|POST",
+        "path": "/php-plain/admin.php?action=delete"
+      },
+      "location": {
+        "file": "php-plain/admin.php",
+        "start_line": 10,
+        "end_line": 12
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin.php",
+          "line": 2,
+          "code": "require_once 'inc/auth.php';",
+          "why": "Includes auth check which only verifies login"
+        },
+        {
+          "file": "php-plain/admin.php",
+          "line": 12,
+          "code": "mysql_query(\"DELETE FROM users WHERE id = $id\");",
+          "why": "Privileged deletion action executed without verifying admin role"
+        }
+      ],
+      "impact": "Any authenticated user can delete other users.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "owasp": [
+        "API5:2023",
+        "A01:2021"
+      ],
+      "recommendation": "Add a server-side role check in the PHP file before executing the delete logic.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "BFLA-R-0066-1",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Any authenticated user can delete users via POST",
+      "route_id": "R-0066",
+      "endpoint": {
+        "method": "POST",
+        "path": "/php-plain/admin/delete_user.php"
+      },
+      "location": {
+        "file": "php-plain/admin/delete_user.php",
+        "start_line": 6,
+        "end_line": 7
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin/delete_user.php",
+          "line": 2,
+          "code": "require_once '../inc/auth.php';",
+          "why": "Includes auth check which only verifies login"
+        },
+        {
+          "file": "php-plain/admin/delete_user.php",
+          "line": 6,
+          "code": "$stmt = $db->prepare(\"DELETE FROM users WHERE id = ?\");",
+          "why": "Privileged deletion action executed without verifying admin role"
+        }
+      ],
+      "impact": "Any authenticated user can delete other users.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "owasp": [
+        "API5:2023",
+        "A01:2021"
+      ],
+      "recommendation": "Add a server-side role check in the PHP file before executing the delete logic.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "BFLA-R-0067-1",
+      "category": "bfla",
+      "subtype": "role_from_request",
+      "title": "Admin role is determined by request parameter instead of server-side check",
+      "route_id": "R-0067",
+      "endpoint": {
+        "method": "POST",
+        "path": "/php-plain/admin/promote.php"
+      },
+      "location": {
+        "file": "php-plain/admin/promote.php",
+        "start_line": 5,
+        "end_line": 7
+      },
+      "evidence": [
+        {
+          "file": "php-plain/admin/promote.php",
+          "line": 2,
+          "code": "require_once '../inc/auth.php';",
+          "why": "Includes auth check which only verifies login"
+        },
+        {
+          "file": "php-plain/admin/promote.php",
+          "line": 5,
+          "code": "if ($_POST['is_admin'] == '1') {",
+          "why": "Privileged action triggered by client-controlled flag"
+        }
+      ],
+      "impact": "Any authenticated user can promote other users to admin.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "owasp": [
+        "API5:2023",
+        "A01:2021"
+      ],
+      "recommendation": "Verify the user's role from the session or database before executing the update.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "BFLA-R-0063-1",
+      "category": "bfla",
+      "subtype": "role_from_request",
+      "title": "User role is determined by request parameter instead of server-side check",
+      "route_id": "R-0063",
+      "endpoint": {
+        "method": "POST",
+        "path": "/php-plain/profile.php"
+      },
+      "location": {
+        "file": "php-plain/profile.php",
+        "start_line": 10,
+        "end_line": 10
+      },
+      "evidence": [
+        {
+          "file": "php-plain/profile.php",
+          "line": 2,
+          "code": "require_once 'inc/auth.php';",
+          "why": "Includes auth check which only verifies login"
+        },
+        {
+          "file": "php-plain/profile.php",
+          "line": 10,
+          "code": "$user->role = $_POST['role'];",
+          "why": "Privileged field assignment from client input"
+        }
+      ],
+      "impact": "Any authenticated user can change their own role to admin.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-285"
+      ],
+      "owasp": [
+        "API5:2023",
+        "A01:2021"
+      ],
+      "recommendation": "Restrict the set of writable fields or explicitly check role before assignment.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0003-1",
+      "category": "mass_assignment",
+      "subtype": "privileged_field_writable",
+      "title": "Account model allows writing the 'role' field via whole object binding",
+      "candidate_id": "M-0003",
+      "endpoint": {
+        "method": "POST|PUT",
+        "path": "/account/save|/account/api"
+      },
+      "location": {
+        "file": "java-legacy/src/com/acme/web/AccountController.java",
+        "start_line": 14
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/web/AccountController.java",
+          "line": 14,
+          "code": "@RequestMapping(value = \"/save\", method = RequestMethod.POST)",
+          "why": "Endpoint accepts POST without explicit role check"
+        },
+        {
+          "file": "java-legacy/src/com/acme/web/AccountController.java",
+          "line": 15,
+          "code": "accountDao.save(account);",
+          "why": "Saves the entire object bound from request"
+        },
+        {
+          "file": "java-legacy/src/com/acme/model/Account.java",
+          "line": 11,
+          "code": "private String role;",
+          "why": "Privileged field 'role' exists in model"
+        }
+      ],
+      "impact": "Any authenticated user can escalate privileges by setting role=admin.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915"
+      ],
+      "owasp": [
+        "API3:2023",
+        "A01:2021"
+      ],
+      "recommendation": "Use a DTO with only editable fields or whitelist allowed properties before saving.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0004-1",
+      "category": "mass_assignment",
+      "subtype": "privileged_field_writable",
+      "title": "Account model allows writing the 'role' field via whole object binding",
+      "candidate_id": "M-0004",
+      "endpoint": {
+        "method": "POST|PUT",
+        "path": "/account/save|/account/api"
+      },
+      "location": {
+        "file": "java-legacy/src/com/acme/web/AccountController.java",
+        "start_line": 27
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/web/AccountController.java",
+          "line": 14,
+          "code": "@RequestMapping(value = \"/save\", method = RequestMethod.POST)",
+          "why": "Endpoint accepts POST without explicit role check"
+        },
+        {
+          "file": "java-legacy/src/com/acme/web/AccountController.java",
+          "line": 15,
+          "code": "accountDao.save(account);",
+          "why": "Saves the entire object bound from request"
+        },
+        {
+          "file": "java-legacy/src/com/acme/model/Account.java",
+          "line": 11,
+          "code": "private String role;",
+          "why": "Privileged field 'role' exists in model"
+        }
+      ],
+      "impact": "Any authenticated user can escalate privileges by setting role=admin.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915"
+      ],
+      "owasp": [
+        "API3:2023",
+        "A01:2021"
+      ],
+      "recommendation": "Use a DTO with only editable fields or whitelist allowed properties before saving.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0005-1",
+      "category": "mass_assignment",
+      "subtype": "privileged_field_writable",
+      "title": "Account model allows writing the 'role' field via BeanUtils.populate",
+      "candidate_id": "M-0005",
+      "endpoint": {
+        "method": "POST",
+        "path": "/profile"
+      },
+      "location": {
+        "file": "java-legacy/src/com/acme/web/ProfileServlet.java",
+        "start_line": 12
+      },
+      "evidence": [
+        {
+          "file": "java-legacy/src/com/acme/web/ProfileServlet.java",
+          "line": 9,
+          "code": "protected void doPost(HttpServletRequest request, HttpServletResponse response)",
+          "why": "Endpoint accepts POST without explicit role check"
+        },
+        {
+          "file": "java-legacy/src/com/acme/web/ProfileServlet.java",
+          "line": 12,
+          "code": "BeanUtils.populate(account, request.getParameterMap());",
+          "why": "Populates all fields from request parameters"
+        },
+        {
+          "file": "java-legacy/src/com/acme/model/Account.java",
+          "line": 11,
+          "code": "private String role;",
+          "why": "Privileged field 'role' exists in model"
+        }
+      ],
+      "impact": "Any authenticated user can escalate privileges by setting role=admin.",
+      "severity": "critical",
+      "confidence": "high",
+      "cwe": [
+        "CWE-915"
+      ],
+      "owasp": [
+        "API3:2023",
+        "A01:2021"
+      ],
+      "recommendation": "Manually copy only safe fields or use a whitelist before populating the model.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "BFLA-R-0032-verdict",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Missing role check at node-express/routes/admin.js:16 (from auditor verdict)",
+      "route_id": "R-0032",
+      "location": {
+        "file": "node-express/routes/admin.js",
+        "start_line": 16
+      },
+      "evidence": [
+        {
+          "file": "node-express/routes/admin.js",
+          "line": 16,
+          "why": "The auditor judged this route 'needs_review' but wrote no finding"
+        }
+      ],
+      "impact": "Generated from the auditor's 'needs_review' verdict; the model wrote no finding for it.",
+      "severity": "medium",
+      "confidence": "low",
+      "cwe": [
+        "CWE-285"
+      ],
+      "recommendation": "Check the caller's role on the server before the privileged action.",
+      "status": "unverified",
+      "endpoint": {
+        "method": "GET",
+        "path": "/reports/export"
+      }
+    },
+    {
+      "finding_id": "BFLA-R-0059-verdict",
+      "category": "bfla",
+      "subtype": "missing_role_check",
+      "title": "Missing role check at php-plain/manage_users.php:1 (from auditor verdict)",
+      "route_id": "R-0059",
+      "location": {
+        "file": "php-plain/manage_users.php",
+        "start_line": 1
+      },
+      "evidence": [
+        {
+          "file": "php-plain/manage_users.php",
+          "line": 1,
+          "why": "The auditor judged this route 'needs_review' but wrote no finding"
+        }
+      ],
+      "impact": "Generated from the auditor's 'needs_review' verdict; the model wrote no finding for it.",
+      "severity": "medium",
+      "confidence": "low",
+      "cwe": [
+        "CWE-285"
+      ],
+      "recommendation": "Check the caller's role on the server before the privileged action.",
+      "status": "unverified",
+      "endpoint": {
+        "method": "POST",
+        "path": "/php-plain/manage_users.php"
+      }
+    },
+    {
+      "finding_id": "MASS-M-0011-verdict",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Mass assignment at php-plain/profile.php:6 (from auditor verdict)",
+      "candidate_id": "M-0011",
+      "location": {
+        "file": "php-plain/profile.php",
+        "start_line": 6
+      },
+      "evidence": [
+        {
+          "file": "php-plain/profile.php",
+          "line": 6,
+          "why": "The auditor judged this candidate 'needs_review' but wrote no finding"
+        }
+      ],
+      "impact": "Generated from the auditor's 'needs_review' verdict; the model wrote no finding for it.",
+      "severity": "medium",
+      "confidence": "low",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Bind only an explicit allow-list of fields; never bind role, owner or balance fields.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0012-verdict",
+      "category": "mass_assignment",
+      "subtype": "privileged_field_writable",
+      "title": "Mass assignment at php-plain/profile.php:10 (from auditor verdict)",
+      "candidate_id": "M-0012",
+      "location": {
+        "file": "php-plain/profile.php",
+        "start_line": 10
+      },
+      "evidence": [
+        {
+          "file": "php-plain/profile.php",
+          "line": 10,
+          "why": "The auditor judged this candidate 'needs_review' but wrote no finding"
+        }
+      ],
+      "impact": "Generated from the auditor's 'needs_review' verdict; the model wrote no finding for it.",
+      "severity": "medium",
+      "confidence": "low",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Bind only an explicit allow-list of fields; never bind role, owner or balance fields.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0001-verdict",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Mass assignment at dotnet-legacy/Web/Controllers/CustomerController.cs:12 (from auditor verdict)",
+      "candidate_id": "M-0001",
+      "location": {
+        "file": "dotnet-legacy/Web/Controllers/CustomerController.cs",
+        "start_line": 12
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Controllers/CustomerController.cs",
+          "line": 12,
+          "why": "The auditor judged this candidate 'needs_review' but wrote no finding"
+        }
+      ],
+      "impact": "Generated from the auditor's 'needs_review' verdict; the model wrote no finding for it.",
+      "severity": "medium",
+      "confidence": "low",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Bind only an explicit allow-list of fields; never bind role, owner or balance fields.",
+      "status": "unverified"
+    },
+    {
+      "finding_id": "MASS-M-0002-verdict",
+      "category": "mass_assignment",
+      "subtype": "whole_object_binding",
+      "title": "Mass assignment at dotnet-legacy/Web/Controllers/CustomerController.cs:30 (from auditor verdict)",
+      "candidate_id": "M-0002",
+      "location": {
+        "file": "dotnet-legacy/Web/Controllers/CustomerController.cs",
+        "start_line": 30
+      },
+      "evidence": [
+        {
+          "file": "dotnet-legacy/Web/Controllers/CustomerController.cs",
+          "line": 30,
+          "why": "The auditor judged this candidate 'needs_review' but wrote no finding"
+        }
+      ],
+      "impact": "Generated from the auditor's 'needs_review' verdict; the model wrote no finding for it.",
+      "severity": "medium",
+      "confidence": "low",
+      "cwe": [
+        "CWE-915"
+      ],
+      "recommendation": "Bind only an explicit allow-list of fields; never bind role, owner or balance fields.",
+      "status": "unverified"
+    }
+  ],
+  "privilege_route_verdicts": [
+    {
+      "route_id": "R-0003",
+      "verdict": "vulnerable"
+    },
+    {
+      "route_id": "R-0007",
+      "verdict": "safe"
+    },
+    {
+      "route_id": "R-0009",
+      "verdict": "needs_review"
+    },
+    {
+      "route_id": "R-0023",
+      "verdict": "vulnerable"
+    },
+    {
+      "route_id": "R-0030",
+      "verdict": "safe"
+    },
+    {
+      "route_id": "R-0032",
+      "verdict": "needs_review"
+    },
+    {
+      "route_id": "R-0057",
+      "verdict": "vulnerable"
+    },
+    {
+      "route_id": "R-0058",
+      "verdict": "vulnerable"
+    },
+    {
+      "route_id": "R-0066",
+      "verdict": "vulnerable"
+    },
+    {
+      "route_id": "R-0067",
+      "verdict": "vulnerable"
+    },
+    {
+      "route_id": "R-0059",
+      "verdict": "needs_review"
+    },
+    {
+      "route_id": "R-0063",
+      "verdict": "vulnerable"
+    }
+  ],
+  "candidate_verdicts": [
+    {
+      "candidate_id": "M-0011",
+      "verdict": "needs_review"
+    },
+    {
+      "candidate_id": "M-0012",
+      "verdict": "needs_review"
+    },
+    {
+      "candidate_id": "M-0001",
+      "verdict": "needs_review"
+    },
+    {
+      "candidate_id": "M-0002",
+      "verdict": "needs_review"
+    },
+    {
+      "candidate_id": "M-0003",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "M-0004",
+      "verdict": "vulnerable"
+    },
+    {
+      "candidate_id": "M-0005",
+      "verdict": "vulnerable"
+    }
+  ]
+}