An authorized, exploitation-based penetration test was performed against the target web application and its software supply chain. Testing identified critical and high-severity issues warranting prompt remediation — most significantly an exploitable SQL injection in the product-search API and multiple dependencies with known critical vulnerabilities (authentication-bypass and remote-code-execution classes).
The single Critical entry (vulnerable components) encompasses 38 CVEs across 10 components — 8 critical, 11 high, 19 medium. Point-in-time result; one free retest is included after remediation.
In-scope: the target web application + API (single origin) and its dependency manifest. Testing was gated to the authorized target by an automated scope-enforcement control (allowlist + resolved-IP validation + authorization-window expiry). Layers executed:
A production engagement adds: source-aware exploitation (attacks the running app with knowledge of the source, producing working PoCs) and manual business-logic testing (privilege escalation, cross-tenant/IDOR, workflow abuse) — the layers that surface logic flaws automation alone misses.
| ID | Finding | Severity | CVSS | Source |
|---|---|---|---|---|
| F-01 | Use of components with known vulnerabilities | Critical | up to 9.8 | SCA |
| F-02 | SQL injection in product-search API | High | 8.6 | DAST |
| F-03 | Backup / source file disclosure | Medium | 5.3 | DAST |
| F-04 | Content-Security-Policy not set | Medium | 4.3 | DAST |
| F-05 | Cross-Domain misconfiguration (permissive CORS) | Medium | 5.4 | DAST |
| F-06 | Session ID in URL rewrite | Medium | 5.3 | DAST |
| F-07 | Missing anti-clickjacking header | Medium | 4.3 | DAST |
| F-08 | Exposed Prometheus metrics endpoint | Medium | 5.3 | Breadth |
The application depends on third-party components with published vulnerabilities. Dependency analysis across the full tree identified 38 CVEs affecting 10 components (8 critical, 11 high, 19 medium). Representative examples:
| Component | CVE | CVSS | Class |
|---|---|---|---|
| jsonwebtoken 0.4.0 | CVE-2015-9235 | 9.8 | Auth / signature bypass |
| express-jwt 0.1.3 | CVE-2020-15084 | 9.1 | Authorization bypass |
| lodash | CVE-2019-10744 | 9.1 | Prototype pollution |
| jsonwebtoken 0.4.0 | CVE-2022-23539 | 8.1 | Weak verification |
q search parameter is injectable; a crafted payload (e.g. q='() alters the backend SQL query, producing an injection-indicating response.The server exposes backup/old copies of files that may reveal source code, configuration, or credentials. Remediation: remove backup artifacts from web roots; block backup extensions at the web server.
No CSP is delivered, materially increasing the impact of any XSS. Remediation: deploy a strict nonce/hash-based CSP (report-only first, then enforce).
Cross-origin controls are more permissive than necessary, allowing other origins to read
responses. Remediation: restrict Access-Control-Allow-Origin to an explicit
trusted allowlist; never combine wildcard with credentials.
Session identifiers appear in URLs, where they can leak via logs, referrer headers, and browser history — enabling session hijacking. Remediation: carry session IDs only in secure, HttpOnly cookies.
Remediation: set Content-Security-Policy: frame-ancestors 'none' (or
X-Frame-Options: DENY).
Returns internal operational telemetry to unauthenticated users. Remediation: require
auth or restrict /metrics to an internal network.
12 low-severity items (COOP/COEP missing, deprecated Feature-Policy, timestamp disclosure, dangerous JS sinks) and informational observations are itemized in Appendix B.
| Priority | Finding(s) | Action | Effort |
|---|---|---|---|
| 1 — now | F-01 (auth libs), F-02 | Patch jsonwebtoken/express-jwt; parameterize the search query | Medium |
| 2 | F-01 (remaining), F-03, F-08 | Patch remaining CVEs; remove backup files; lock down /metrics | Medium |
| 3 | F-04–F-07 | Add CSP, tighten CORS, cookie-only sessions, anti-clickjacking header | Low |
| Finding | TSC | Notes |
|---|---|---|
| F-01, F-02 | CC6.1 / CC7.1 | Exploitable data access + component vulns undermining access controls |
| F-03, F-08 | CC6.1 | Unauthenticated exposure of internal artifacts/data |
| F-04–F-07 | CC7.1 | Application-hardening gaps |
Point-in-time result. After remediation, one free retest re-verifies Critical/High findings and a Letter of Attestation is issued for auditor and enterprise-customer submission.