Penetration test report

New search API

Commit
5f6c2d8 · feat/search
Pipeline
GitHub Actions #2172
Target
staging.acme.dev
Profile
web-app+api
Duration
8m 12s

Failed policy: block on high or above

Merging feat/search is blocked until the findings are fixed or accepted.

Critical

1

First run on this branch

High

0

First run on this branch

Medium

3

First run on this branch

Low

4

First run on this branch

Fixed in this run

0

Retested and confirmed

Checks run

401

First run on this branch

Findings

A single quote in the search term changes the result count and a time-based payload delays the response by the injected amount, which shows the term reaches the database unescaped.

Request

GET /api/v2/search?q=acme'%20AND%20pg_sleep(5)--
Host: staging.acme.dev
Authorization: Bearer ‹member›

Response

HTTP/1.1 200 OK
(response delayed 5.02 s; baseline 0.08 s)

How to fix

Pass the search term as a bound parameter instead of building the SQL string, and add the endpoint to the integration tests with the payload above.