A report you can act on — not a wall of scanner output

01

Executive summary

At a glance

Six findings were identified: one Critical, one High, one Medium, two Low and one Informational. The Critical and High findings can be chained to expose customer personal and financial records at scale.

02

Vulnerability summary

03

OWASP Top 10 (2025) coverage

• A01:2025Broken Access ControlIDOR on /v1/invoicesFail
• A02:2025Security MisconfigurationMissing CSP, short HSTSFail
• A03:2025Software Supply Chain FailuresEnd-of-life React 16.13.1Fail
• A04:2025Cryptographic FailuresPass
• A05:2025InjectionSQL injection in auth APIFail
• A06:2025Insecure DesignPass
• A07:2025Authentication FailuresPass
• A08:2025Software or Data Integrity FailuresPass
• A09:2025Logging & Alerting FailuresOut of scope for this engagementN/A
• A10:2025Mishandling of Exceptional ConditionsPass

04

Reconnaissance

Passive reconnaissance mapped the portal’s public attack surface. Three subdomains point to the portal origin behind Cloudflare, while one administrative host resolves directly and bypasses the WAF.

• The status page publishes verbose build metadata (git SHA, build date).
• Two staging subdomains (stg-*) were accessible during the testing window.

05

Findings

Six representative findings, ordered by severity. Each is reproducible and mapped to a fix.

No findings match this filter.

1. OS-01

   Unauthenticated SQL injection in the portal authentication API

   CriticalOpenA05:2025CWE-89

   CVSS 3.19.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

   The `email` field of the login endpoint is concatenated directly into a SQL query without parameterisation. A time-based blind injection confirms the flaw and allows authentication bypass and arbitrary read access to the `users` table, including e-mail addresses, roles and bcrypt password hashes.

   Affected

   • POST https://api.aurenta.example/v1/auth/login

   Impact

   An unauthenticated attacker could sign in as any user, including an administrator, and extract the customer identity store. This could lead to account takeover and a personal-data breach requiring assessment under the GDPR notification rules.

   Technical detail

   A five-second delay for the test input below, compared with an immediate response to the control request, confirms time-based blind SQL injection:

   HTTP request

   POST /v1/auth/login HTTP/2
   Host: api.aurenta.example
   Content-Type: application/json
   
   {"email":"x' OR (SELECT 1 FROM (SELECT SLEEP(5))a)-- -","password":"x"}
   

   HTTP response

   HTTP/2 200
   content-type: application/json
   x-response-time: 5024ms
   
   {"token":"eyJhbG...","role":"admin"}
   

   Evidence

   sqlmap identified the following injection point:
   Parameter: email (JSON)
       Type: time-based blind
       Title: MySQL >= 5.0.12 AND time-based blind (SLEEP)
   available databases [2]: aurenta_portal, information_schema
   Database: aurenta_portal  Table: users  [48,213 entries]
   

   Remediation

   Replace string-built SQL with parameterised statements or prepared queries. Run the application under a least-privilege database account, validate input against an allowlist and deploy a temporary WAF rule until the code fix is released. Rotate any credentials that may have been exposed.

   References

   • https://owasp.org/www-community/attacks/SQL_Injection
   • https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html

2. OS-02

   Broken access control exposes every customer’s invoices (IDOR)

   HighOpenA01:2025CWE-639

   CVSS 3.18.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

   Invoice records use sequential integer IDs and are returned without an ownership check. Any authenticated user can change the identifier to enumerate and download invoices belonging to other customers, including names, addresses and payment summaries.

   Affected

   • GET https://api.aurenta.example/v1/invoices/{id}

   Impact

   A single low-privilege account could retrieve the invoice history of the entire customer base, exposing personal and financial data at scale and potentially triggering GDPR notification obligations.

   HTTP request

   GET /v1/invoices/100245 HTTP/2
   Host: api.aurenta.example
   Authorization: Bearer <attacker-session>
   

   HTTP response

   HTTP/2 200
   content-type: application/pdf
   content-disposition: attachment; filename="invoice-100245.pdf"
   
   %PDF-1.7  (invoice for a *different* customer)
   

   Evidence

   for id in $(seq 100240 100260); do
     curl -s -o "inv-$id.pdf" -w "%{http_code}\n" \
       -H "Authorization: Bearer $T" \
       https://api.aurenta.example/v1/invoices/$id
   done
   # 21/21 returned HTTP 200 — none belonged to the test account.
   

   Remediation

   Enforce object-level authorisation on every request by verifying server-side that the authenticated principal may access the requested resource. Replace sequential IDs with non-enumerable identifiers such as UUIDv4 and apply deny-by-default access control.

   References

   • https://owasp.org/www-project-api-security/
   • https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html

3. OS-03

   Content Security Policy (CSP) is not implemented

   MediumHardening requiredA02:2025CWE-693

   CVSS 3.14.0CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

   The application returns no `Content-Security-Policy` header on any page observed during testing.

   Affected

   • https://portal.aurenta.example/
   • https://portal.aurenta.example/users/sign_in
   • https://portal.aurenta.example/admin/*

   Impact

   Without a CSP, the browser cannot restrict the effects of reflected or stored XSS, unauthorised third-party script loading or data exfiltration after a successful injection. This removes an important defence-in-depth control.

   HTTP response

   HTTP/2 200
   content-type: text/html; charset=utf-8
   strict-transport-security: max-age=15552000
   x-frame-options: DENY
   x-content-type-options: nosniff
   (no Content-Security-Policy header)
   

   Remediation

   Deploy a strict CSP, starting with the sign-in and administration pages. Begin in `Content-Security-Policy-Report-Only` mode, review violations and then enforce the policy. Avoid `unsafe-inline` for scripts; use nonces or hashes.

   References

   • https://www.w3.org/TR/CSP3/
   • https://owasp.org/www-community/attacks/xss/

4. OS-04

   Outdated JavaScript library — React 16.13.1

   LowRecommended updateA03:2025CWE-1104

   The production bundle includes React 16.13.1 (March 2020), which is no longer supported. Even where no directly applicable CVE is known, unsupported frameworks and their transitive dependencies increase maintenance and security risk.

   Affected

   • https://portal.aurenta.example/assets/application-90283b17.js

   Impact

   Running an unsupported framework increases the likelihood of an unpatched vulnerability entering production via a transitive dependency.

   Remediation

   Adopt continuous dependency review (Dependabot / Renovate), add software composition analysis (SCA) to CI, and plan a migration to React 18/19.

   References

   • https://react.dev/versions

5. OS-05

   HSTS max-age is below one year

   LowHardening requiredA02:2025CWE-16

   The `Strict-Transport-Security` header uses `max-age=15552000` (180 days), below the one-year duration commonly required before a domain is eligible for HSTS preload.

   Affected

   • https://portal.aurenta.example/

   Impact

   A shorter `max-age` reduces the period during which the browser refuses plain HTTP after its last secure visit, slightly increasing exposure to SSL-stripping attacks.

   Remediation

   After confirming that all subdomains support HTTPS, set `Strict-Transport-Security: max-age=63072000; includeSubDomains; preload` and then consider submitting the domain to the HSTS preload list.

   References

   • https://hstspreload.org/

6. OS-06

   Publicly accessible recursive DNS resolver

   InfoInformational

   The portal host answers recursive DNS queries for foreign zones from unauthorised source addresses (RD+RA flags set).

   Affected

   • 203.0.113.10:53

   Impact

   Open resolvers can be abused for amplification in reflected DDoS attacks against third parties. No direct impact on Aurenta data was demonstrated; the issue is included for completeness.

   Remediation

   Restrict UDP/TCP 53 at the perimeter to authorised clients, or disable recursion for the public interface.

06

How the findings chain into a breach

Individual findings matter less than what they enable together. This is the sequence we demonstrated — from mapping the surface to mass data exposure.

07

Social engineering (phishing campaign)

A pretext-based phishing campaign targeted Aurenta employees using a cloned portal sign-in page. Submitted credentials were discarded immediately on the server and were not retained.

Employees targeted

700

Credentials entered

154 (22%)

Reported to IT

38 (5%)

A 22% credential-submission rate indicates a material awareness gap. We recommend quarterly reinforcement and targeted follow-up for employees who repeatedly interact with simulations.