Sample API Security Scan Report

CRITICAL · CVSS 9.4 OWASP API1

Broken Object Level Authorization (BOLA / IDOR)

DastPilot detected that resource endpoints did not validate authority parameters. An authenticated user accounts could fetch details of other accounts simply by mutating the userId parameter in the HTTP path template.

Vulnerability Proof (HTTP Evidence)

GET /v1/users/admin-user-09/profile HTTP/1.1 Host: api-staging.example.com Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... User-Agent: DastPilot Scanner v2.4 Accept: application/json Connection: close

HTTP/1.1 200 OK Content-Type: application/json Content-Length: 342 Connection: close { "userId": "admin-user-09", "username": "admin_superuser", "email": "[email protected]", "internal_key": "sk_live_51M081fJszG9...", "role": "owner" }

Check that the authenticated caller has permission to view the requested resource: # Secure API controller example (Python/FastAPI) @app.get("/v1/users/{userId}/profile") async def get_user_profile(userId: str, current_user: User = Depends(get_current_user)): # CRITICAL: Validate ownership or administration authorization if current_user.id != userId and current_user.role != "admin": raise HTTPException( status_code=status.HTTP_403_FORBIDDEN, detail="You do not have access to this user profile" ) return db.get_profile(userId)

HIGH · CVSS 8.2 OWASP API2

Broken User Authentication (Missing JWT Check)

DastPilot accessed high-value checkout endpoints without supplying the required Bearer token, receiving valid 200 responses. Secure business flows must validate authentication tokens.

Vulnerability Proof (HTTP Evidence)

POST /v1/orders/checkout HTTP/1.1 Host: api-staging.example.com Content-Type: application/json Content-Length: 68 Connection: close { "cartId": "cart_883294", "paymentMethod": "saved_card" }

HTTP/1.1 200 OK Content-Type: application/json Content-Length: 148 Connection: close { "orderId": "ord_7812984", "status": "checkout_initiated", "amount": 249.00 }

Ensure authentication middleware intercepts endpoints correctly: # Express.js Middleware integration const auth = require('./middleware/auth'); // Protect checkout endpoint router.post('/checkout', auth, async (req, res) => { // Safe: auth middleware sets req.user and rejects empty tokens const order = await processCheckout(req.user.id, req.body); res.json(order); });

MEDIUM · CVSS 5.3 OWASP API8

Security Misconfiguration (Stack Trace Leak)

DastPilot caused database exceptions by fuzzing query parameter types, leaking verbose stack trace logs in JSON responses. Production APIs must intercept backend exceptions and return sanitised error objects.

Vulnerability Proof (HTTP Evidence)

GET /v1/health?verbose[]=true HTTP/1.1 Host: api-staging.example.com Connection: close

HTTP/1.1 500 Internal Server Error Content-Type: application/json Content-Length: 512 Connection: close { "error": "TypeMismatchException", "message": "SQL error in query execution logic", "stackTrace": [ "at com.example.controllers.HealthCheck.check(HealthCheck.java:82)", "at com.example.database.SqlDialect.execute(SqlDialect.java:140)", "at org.postgresql.jdbc.PgStatement.executeInternal(PgStatement.java:492)", "Caused by: org.postgresql.util.PSQLException: ERROR: invalid input syntax for type boolean" ] }

Set production environments to sanitize database error trace objects: # Java error handling config block @ExceptionHandler(Exception.class) public ResponseEntity handleException(Exception ex) { String message = "An internal error occurred."; List details = null; // Only return trace logs in DEVELOPMENT mode, never in production! if (env.getProperty("app.mode").equals("development")) { message = ex.getMessage(); details = Arrays.asList(ex.getStackTrace()); } return new ResponseEntity<>(new ErrorResponse(message, details), HttpStatus.INTERNAL_SERVER_ERROR); }

Vulnerability Scan Report

Scan Findings

Broken Object Level Authorization (BOLA / IDOR)

Vulnerability Proof (HTTP Evidence)

Broken User Authentication (Missing JWT Check)

Vulnerability Proof (HTTP Evidence)

Security Misconfiguration (Stack Trace Leak)

Vulnerability Proof (HTTP Evidence)