During the engagement, a total of 3 findings were identified against https://api.acmepay.example: 1 high, 1 medium and 1 low.
The most significant issue is Broken Object Level Authorization on /v1/transactions/{id} (High, CVSS 8.1), which should be remediated as a priority.
The overall risk is assessed as High. Remediation of the high-severity findings should be scheduled promptly.
Detailed technical findings, evidence, and remediation guidance are provided in the following sections. All testing was performed with appropriate authorization.
| Severity | Count | CVSS Range |
|---|---|---|
| Critical | 0 | 9.0 – 10.0 |
| High | 1 | 7.0 – 8.9 |
| Medium | 1 | 4.0 – 6.9 |
| Low | 1 | 0.1 – 3.9 |
| Info | 0 | 0.0 |
| Step | Status |
|---|---|
| API discovery & inventory (versions, endpoints, shadow APIs) | Complete |
| Authentication testing (tokens, sessions, MFA, OAuth flows) | Complete |
| Authorization testing (BOLA / IDOR across roles) | Complete |
| Object property level authorization (mass assignment) | Complete |
| Function level authorization (admin vs user routes) | Complete |
| Input validation & injection (SQLi, NoSQLi, XSS, SSTI, SSRF) | Complete |
| Rate limiting & resource consumption testing | Complete |
| Business flow / abuse-case testing | Complete |
| JWT & token security (alg confusion, weak secrets, expiry) | Pending |
| GraphQL / gRPC / WebSocket specific testing | Pending |
| Security misconfiguration (CORS, headers, error handling) | Pending |
| Retesting of confirmed findings | Pending |
| ID | Title | Severity | CVSS | Status |
|---|---|---|---|---|
| F-001 | Broken Object Level Authorization on /v1/transactions/{id} | High | 8.1 | open |
| F-002 | Unrestricted resource consumption on /v2/ledger | Medium | 7.5 | open |
| F-003 | Verbose error disclosure leaks stack traces | Low | 5.3 | open |
/v1/transactions/{id}
GET
id
JWT
Transaction endpoint returns full transaction data for any ID regardless of the authenticated user's ownership of the record.
GET /v1/transactions/884211 with a token for user 501 returned user 502's transaction with card PAN.
Complete transaction and PII disclosure across the customer base.
Validate object ownership on every object-level read/write; use opaque identifiers.
/v2/ledger
GET
page_size
no
Ledger endpoint honors page_size up to 100000 with no rate limiting, enabling resource exhaustion and inflated cloud costs.
page_size=100000 returned in 14s; 50 concurrent requests saturated the pod.
Denial of service for all API consumers and elevated infrastructure costs.
Cap pagination, enforce per-client rate limits and payload quotas.
/v1/login
POST
body
no
Malformed JSON requests return 500 responses containing full Django debug tracebacks with internal paths and dependency versions.
POST /v1/login with invalid body returned <pre>traceback…django/core/handlers…</pre>
Information disclosure that aids reconnaissance and version-based attacks.
Return generic errors in production; log details server-side only.
The engagement identified 3 finding(s). Findings should be tracked to closure with defined owners and target dates. High and critical findings should be remediated before the application is exposed to untrusted users.