OWASP Top 10 Scanner

OWASP Top 10 Scan — src/api/users.ts

Lines scanned: 347 · Findings: 12 · Categories hit: A01, A02, A03, A05, A07, A09

Findings Table

Exploit Walkthrough — Finding 1 Critical

// Line 83–86 — vulnerable
const query = `SELECT * FROM users WHERE email = '${req.body.email}'`;
const result = await db.raw(query);

A POST to /login with a body of {"email": "x' OR '1'='1' --"} produces the query:

SELECT * FROM users WHERE email = 'x' OR '1'='1' --'

That returns every row in users. Combined with the plaintext-compare at line 68 (Finding 10), the first row is silently authenticated. The attacker is logged in as whichever user the database returns first — typically the oldest admin.

Fix. Parameterize:

const result = await db('users').where({ email: req.body.email }).select('*');
// Or with raw + binding:
const result = await db.raw('SELECT * FROM users WHERE email = ?', [req.body.email]);

Critical / High Detail

Finding 2 — IDOR Critical

// Line 140–145 — vulnerable
const targetUser = await User.findById(req.params.userId);
return res.json(targetUser);

No ownership or role check. Any authenticated user can read any other user's record. Add the check before the lookup:

if (req.user.id !== req.params.userId && req.user.role !== 'admin') {
  return res.status(403).json({ error: 'Forbidden' });
}

Finding 3 — JWT without expiry High

jwt.sign(..., { algorithm: 'HS256' }) with no expiresIn issues an indefinitely valid token. Combined with no revocation table in this file, stolen tokens never expire. Set expiresIn: '15m' and pair with a short-lived refresh token.

Finding 4 — ORDER BY injection High

Parameterized queries cannot bind column names — allowlist instead:

const ALLOWED = ['name', 'email', 'created_at'] as const;
const sortBy = ALLOWED.includes(req.query.sortBy as any) ? req.query.sortBy : 'created_at';
const users = await db('users').orderBy(sortBy as string);

Finding 5 — CORS wildcard High

Replace cors({ origin: '*' }) with an explicit allowlist read from ALLOWED_ORIGINS. Required when credentials: true (which authenticated APIs need).

Finding 6 — MD5 password hashing High

MD5 is reversible via rainbow tables and crackable at billions of guesses per second on commodity GPUs. Switch to bcrypt.hash(password, 12) and force a password reset for anyone whose hash was stored under MD5.

Mitigation Priority

PR Reviewer Checklist

• No string-interpolated SQL anywhere in the diff
• Every endpoint accepting a resource ID checks ownership or role first
• JWT signing sets expiresIn and pairs with a refresh-token flow
• Passwords hashed with bcrypt (factor 12+) or argon2; constant-time compare via the library
• CORS uses an explicit origin allowlist on authenticated routes
• 5xx responses return generic messages; details go to structured logger only
• Body fields explicitly destructured before Object.assign — no mass assignment
• Auth events emit to structured logger with IP, timestamp, user ID

Scan based on static pattern analysis of src/api/users.ts (347 lines) only. Middleware, ORM configuration, and environment files were not scanned and may contain mitigating controls or additional issues not reflected here.

This sample illustrates the skill's output format. Names, metrics, and operational details are illustrative unless the artifact explicitly analyzes public information.