Web Application & API
Security Assessment

Summary

The reporting export endpoint builds its SQL query by concatenating the from and to date parameters directly into the statement. The to parameter is not parameterised, allowing an authenticated user to inject arbitrary SQL. The database responds to boolean and time-based payloads, confirming an exploitable injection that yields read access to the full database.

Impact

An attacker with any customer login can extract arbitrary data from the application database — including other customers' PII, account balances, and the users table containing password hashes and password-reset tokens. This is a direct, single-step path to a large-scale data breach.

Evidence

GET /api/v2/reports/export?from=2026-01-01&to=2026-08-01'+AND+'1'='1 HTTP/1.1
Host: api.northwind-sample.test
Authorization: Bearer <customer-token>

-- Returns HTTP 200 with the normal report.
-- Changing the tail to  ...'+AND+'1'='2  returns an empty set,
-- confirming the condition is evaluated by the database.

...&to=2026-08-01'+AND+(SELECT+1+FROM+PG_SLEEP(5))+IS+NOT+NULL--

-- Response delayed by ~5s, confirming query execution.
-- Full data extraction was demonstrated in a controlled manner
-- and shared privately with the Northwind team; payloads redacted here.

Steps to reproduce

1. Authenticate to the API as a standard customer and capture the bearer token.
2. Send a request to /api/v2/reports/export with a valid date range through an intercepting proxy.
3. Append ' AND '1'='1 to the to parameter — the report returns normally.
4. Change it to ' AND '1'='2 — the report returns empty, proving the injection.
5. Use a time-based payload to confirm blind execution without reading data.

References: OWASP Injection Prevention Cheat Sheet · CWE-89 · OWASP API8:2023 Security Misconfiguration.

Summary

The document-retrieval endpoint checks that the caller is authenticated but does not verify that the requested document belongs to the calling user. Document identifiers are sequential integers, so any authenticated user can enumerate and download every document in the system.

Impact

Full read access to all customers' uploaded documents — bank statements, ID scans, and signed agreements. Because identifiers are sequential, the entire corpus can be harvested with a simple loop.

Evidence

GET /api/v2/documents/10493 HTTP/1.1
Host: api.northwind-sample.test
Authorization: Bearer <user-A-token>

HTTP/1.1 200 OK
Content-Type: application/pdf
Content-Disposition: attachment; filename="statement-userB-jul2026.pdf"

-- Document 10493 belongs to a different customer,
-- yet is returned to user A without an authorization error.

Steps to reproduce

1. Log in as test user A and note the ID of one of your own documents (e.g. 10480).
2. Request neighbouring IDs (10481, 10482…) with user A's token.
3. Observe that documents owned by other customers are returned successfully.

References: OWASP API1:2023 BOLA · CWE-639 · OWASP Authorization Cheat Sheet.

Summary

The import feature fetches a document from a user-supplied URL server-side. The URL is not validated against an allow-list, so the server can be induced to make requests to internal addresses that are not reachable from the internet.

Impact

An attacker can map and reach internal-only services from the application server — including the cloud metadata endpoint, which in many configurations exposes temporary credentials. This expands the blast radius from the application to the surrounding internal network.

Evidence

POST /api/v2/documents/import HTTP/1.1
Host: api.northwind-sample.test
Authorization: Bearer <customer-token>
Content-Type: application/json

{"source_url":"http://169.254.169.254/latest/meta-data/"}

-- The response body echoes the internal metadata listing,
-- proving the server followed the attacker-controlled URL.
-- Credential paths were NOT retrieved during testing.

Steps to reproduce

1. Call the import endpoint with a source_url pointing to an internal address.
2. Observe that the server's response reflects content only reachable from inside the network.
3. Confirm external URLs still work, ruling out a generic error.

References: OWASP SSRF Prevention Cheat Sheet · CWE-918.

Summary

The API accepts JSON Web Tokens whose header specifies alg: none, and does not reject tokens with a stripped signature. An attacker who obtains any valid token structure can forge one with modified claims (for example, a different user ID) without knowing the signing key.

Impact

Identity spoofing. Combined with the sequential user IDs seen elsewhere, an attacker could craft a token asserting another user's identity. Scored Medium because the current claim set limits immediate privilege escalation, but the underlying trust failure is serious.

Evidence

Header : {"alg":"none","typ":"JWT"}
Payload: {"sub":"1042","role":"customer","exp":...}
Signature: <omitted>

-- Request with the unsigned token returns HTTP 200
-- and serves data for sub=1042, confirming no verification.

References: OWASP JWT Cheat Sheet · CWE-347.

Summary

The ticket subject field is stored without output encoding and rendered directly into the staff support console. A script placed in the subject executes in the browser of any staff member who views the ticket queue.

Impact

A customer can run script in a staff member's authenticated session — a path to session theft or actions performed as support staff. Scored Medium because it requires a staff member to view the queue, which is a routine action.

Evidence

POST /api/v2/support/tickets
{"subject":"<img src=x onerror=CONSOLE_PoC()>","body":"..."}

-- When the staff console renders the queue, the handler fires.
-- A benign console proof-of-concept was used; no session data
-- was exfiltrated during testing.

References: OWASP XSS Prevention Cheat Sheet · CWE-79.

Summary

Responses from the portal omit several recommended security headers. On their own these do not create a vulnerability, but they weaken defence-in-depth and would make issues such as DL-2026-005 easier to exploit.

Evidence

HTTP/1.1 200 OK
Server: nginx
Content-Type: text/html
-- Absent: Content-Security-Policy
-- Absent: Strict-Transport-Security
-- Absent: X-Content-Type-Options: nosniff
-- Absent: Referrer-Policy

References: OWASP Secure Headers Project · CWE-693.

Summary

Malformed requests cause the API to return full stack traces, framework versions, and internal file paths. This is not directly exploitable but hands an attacker reconnaissance that accelerates other attacks.

Evidence

HTTP/1.1 500 Internal Server Error
{"error":"SequelizeDatabaseError",
 "stack":"at /srv/app/services/report.js:88 ...",
 "framework":"Express 4.x / Node 20"}

References: OWASP Error Handling Cheat Sheet · CWE-209.