@waftester/cli 2.8.0

package/payloads/community/services/immich.json

@@ -0,0 +1,423 @@
+[
+  {
+    "id": "SVC-IMMICH-001",
+    "payload": "/api/assets/../../admin/config",
+    "tags": ["asset", "traversal", "admin-access", "quick", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Asset path traversal to admin config endpoint",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/assets/"
+  },
+  {
+    "id": "SVC-IMMICH-002",
+    "payload": "/api/assets/..%2f..%2fuser%2fme",
+    "tags": ["asset", "traversal", "encoded", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Asset path traversal with URL encoding to user endpoint",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/assets/"
+  },
+  {
+    "id": "SVC-IMMICH-003",
+    "payload": "/api/assets/../../../etc/passwd",
+    "tags": ["asset", "traversal", "file-read", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Asset path traversal attempting system file read",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/assets/"
+  },
+  {
+    "id": "SVC-IMMICH-004",
+    "payload": "/api/assets/test%00.jpg",
+    "tags": ["asset", "null-byte", "quick", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Asset ID with null byte injection",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/assets/"
+  },
+  {
+    "id": "SVC-IMMICH-005",
+    "payload": "/api/assets/../albums/shared",
+    "tags": ["asset", "traversal", "idor", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Asset traversal to shared albums (IDOR)",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/assets/"
+  },
+  {
+    "id": "SVC-IMMICH-006",
+    "payload": "/api/assets",
+    "method": "DELETE",
+    "body": "{\"ids\":[\"*\"]}",
+    "tags": ["bulk", "injection", "data-destruction", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Bulk delete with wildcard injection",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/assets"
+  },
+  {
+    "id": "SVC-IMMICH-007",
+    "payload": "/api/assets",
+    "method": "DELETE",
+    "body": "{\"ids\":[\"1 OR 1=1\"]}",
+    "tags": ["bulk", "sqli", "data-destruction", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Bulk delete with SQL injection in ID array",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/assets"
+  },
+  {
+    "id": "SVC-IMMICH-008",
+    "payload": "/api/assets",
+    "method": "PUT",
+    "body": "{\"ids\":[\"../../admin/assets\"]}",
+    "tags": ["bulk", "traversal", "privilege-escalation", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Bulk update with path traversal in ID array",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/assets"
+  },
+  {
+    "id": "SVC-IMMICH-009",
+    "payload": "/api/assets",
+    "method": "POST",
+    "body": "{\"ids\":[\"1\",\"2\",\"3\",\"...\"], \"repeat\": 10000}",
+    "tags": ["bulk", "dos", "resource-exhaustion", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Bulk operation with excessive ID count (DoS)",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/assets"
+  },
+  {
+    "id": "SVC-IMMICH-010",
+    "payload": "/api/assets",
+    "method": "PUT",
+    "body": "{\"ids\":[\"%00null\",\"../user2\"]}",
+    "tags": ["bulk", "null-byte", "traversal", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Bulk update with null byte and traversal in IDs",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/assets"
+  },
+  {
+    "id": "SVC-IMMICH-011",
+    "payload": "/api/assets/1/metadata",
+    "method": "PUT",
+    "body": "{\"exifData\":{\"UserComment\":\"<script>alert(1)</script>\"}}",
+    "tags": ["metadata", "xss", "stored", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Metadata injection with XSS in EXIF field",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/assets/{id}/metadata"
+  },
+  {
+    "id": "SVC-IMMICH-012",
+    "payload": "/api/assets/1/metadata",
+    "method": "PUT",
+    "body": "{\"exifData\":{\"GPSLatitude\":\"../../config\"}}",
+    "tags": ["metadata", "traversal", "injection", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Metadata injection with path traversal in GPS field",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/assets/{id}/metadata"
+  },
+  {
+    "id": "SVC-IMMICH-013",
+    "payload": "/api/assets/1/metadata",
+    "method": "PUT",
+    "body": "{\"customKey\":\"' OR '1'='1\"}",
+    "tags": ["metadata", "sqli", "injection", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Metadata injection with SQL injection in custom key",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/assets/{id}/metadata"
+  },
+  {
+    "id": "SVC-IMMICH-014",
+    "payload": "/api/assets/1/metadata",
+    "method": "PUT",
+    "body": "{\"description\":\"{{constructor.constructor('return process.env')()}}\"}",
+    "tags": ["metadata", "ssti", "info-disclosure", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Metadata injection with SSTI attempting env leak",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/assets/{id}/metadata"
+  },
+  {
+    "id": "SVC-IMMICH-015",
+    "payload": "/api/assets/1/metadata",
+    "method": "PUT",
+    "body": "{\"tags\":[\"$where\",\"this.password\"]}",
+    "tags": ["metadata", "nosqli", "injection", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Metadata injection with NoSQL injection in tags",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/assets/{id}/metadata"
+  },
+  {
+    "id": "SVC-IMMICH-016",
+    "payload": "/api/devices",
+    "tags": ["device", "enumeration", "info-disclosure", "quick", "medium"],
+    "expected_block": false,
+    "severity_hint": "Medium",
+    "notes": "Device enumeration (should require auth)",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/devices"
+  },
+  {
+    "id": "SVC-IMMICH-017",
+    "payload": "/api/devices/1",
+    "tags": ["device", "idor", "info-disclosure", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Device access via sequential ID (IDOR)",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/devices/{id}"
+  },
+  {
+    "id": "SVC-IMMICH-018",
+    "payload": "/api/devices/../admin/devices",
+    "tags": ["device", "traversal", "admin-access", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Device traversal to admin devices endpoint",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/devices"
+  },
+  {
+    "id": "SVC-IMMICH-019",
+    "payload": "/api/devices/test%2f..%2fadmin",
+    "tags": ["device", "traversal", "encoded", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Device enumeration with URL-encoded traversal",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/devices/{id}"
+  },
+  {
+    "id": "SVC-IMMICH-020",
+    "payload": "/api/devices/00000000-0000-0000-0000-000000000001",
+    "tags": ["device", "enumeration", "predictable-id", "medium"],
+    "expected_block": false,
+    "severity_hint": "Medium",
+    "notes": "Device access via predictable UUID",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/devices/{id}"
+  },
+  {
+    "id": "SVC-IMMICH-021",
+    "payload": "/api/face",
+    "method": "PUT",
+    "body": "{\"id\":\"../../admin/face\",\"data\":\"malicious_vector\"}",
+    "tags": ["ml", "poisoning", "traversal", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Face data poisoning with path traversal in ID",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/face"
+  },
+  {
+    "id": "SVC-IMMICH-022",
+    "payload": "/api/face",
+    "method": "PUT",
+    "body": "{\"id\":\"<img src=x onerror=alert(1)>\",\"embedding\":[0.1,0.2]}",
+    "tags": ["ml", "xss", "stored", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Face data poisoning with XSS in face ID",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/face"
+  },
+  {
+    "id": "SVC-IMMICH-023",
+    "payload": "/api/face",
+    "method": "PUT",
+    "body": "{\"personId\":\"../../../user-admin/person-1\",\"faceId\":\"1\"}",
+    "tags": ["ml", "traversal", "privilege-escalation", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Face person reassignment with path traversal",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/face"
+  },
+  {
+    "id": "SVC-IMMICH-024",
+    "payload": "/api/face",
+    "method": "POST",
+    "body": "{\"embedding\":[999,999,999], \"personId\":\"admin\"}",
+    "tags": ["ml", "poisoning", "cross-user", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Face embedding poisoning targeting admin user",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/face"
+  },
+  {
+    "id": "SVC-IMMICH-025",
+    "payload": "/api/face",
+    "method": "PUT",
+    "body": "{\"data\":{\"name\":\"{{7*7}}\",\"embedding\":[1,2,3]}}",
+    "tags": ["ml", "ssti", "injection", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Face data with SSTI in name field",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/face"
+  },
+  {
+    "id": "SVC-IMMICH-026",
+    "payload": "/api/people/1/reassign",
+    "method": "POST",
+    "body": "{\"targetPersonId\":\"../../admin-person\"}",
+    "tags": ["person", "traversal", "face-hijacking", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Person reassignment with admin face hijacking",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/people/{id}/reassign"
+  },
+  {
+    "id": "SVC-IMMICH-027",
+    "payload": "/api/people/1/merge",
+    "method": "POST",
+    "body": "{\"ids\":[\"../admin/person-1\",\"2\"]}",
+    "tags": ["person", "traversal", "privilege-escalation", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Person merge with path traversal in face ID",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/people/{id}/merge"
+  },
+  {
+    "id": "SVC-IMMICH-028",
+    "payload": "/api/people/reassign",
+    "method": "POST",
+    "body": "{\"faceId\":\"1\",\"personId\":\"admin\"}",
+    "tags": ["person", "unauthorized", "face-hijacking", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Unauthorized person reassignment to admin",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/people/reassign"
+  },
+  {
+    "id": "SVC-IMMICH-029",
+    "payload": "/api/search/metadata?query=' OR '1'='1",
+    "tags": ["search", "sqli", "quick", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Search with SQL injection in query",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/search/metadata"
+  },
+  {
+    "id": "SVC-IMMICH-030",
+    "payload": "/api/search/metadata?query=../../config",
+    "tags": ["search", "traversal", "info-disclosure", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Search with path traversal in query",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/search/metadata"
+  },
+  {
+    "id": "SVC-IMMICH-031",
+    "payload": "/api/search/smart?query=<script>alert(1)</script>",
+    "tags": ["search", "xss", "reflected", "high"],
+    "expected_block": true,
+    "severity_hint": "High",
+    "notes": "Smart search with reflected XSS",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/search/smart"
+  },
+  {
+    "id": "SVC-IMMICH-032",
+    "payload": "/api/search/person?name=*)(&(userPassword=*)",
+    "tags": ["search", "ldapi", "injection", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "Person search with LDAP injection",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/search/person"
+  },
+  {
+    "id": "SVC-IMMICH-033",
+    "payload": "/api/oauth/callback?code=malicious&state=../../admin/login",
+    "tags": ["oauth", "callback-manipulation", "quick", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "OAuth callback with traversal in state parameter",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/oauth/callback"
+  },
+  {
+    "id": "SVC-IMMICH-034",
+    "payload": "/api/oauth/authorize?redirect_uri=https://evil.com",
+    "tags": ["oauth", "open-redirect", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "OAuth authorize with open redirect",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/oauth/authorize"
+  },
+  {
+    "id": "SVC-IMMICH-035",
+    "payload": "/api/oauth/mobile/redirect?url=javascript:alert(1)",
+    "tags": ["oauth", "xss", "javascript-protocol", "critical"],
+    "expected_block": true,
+    "severity_hint": "Critical",
+    "notes": "OAuth mobile redirect with javascript: protocol",
+    "category": "Service-Specific",
+    "service": "immich",
+    "endpoint": "/api/oauth/mobile/redirect"
+  }
+]