cloudfoundry/stratos

Database Error Pattern should not be displayed

jbuns opened this issue · 2 comments

jbuns commented

Stratos Version

4.4.0

Frontend Deployment type

  • Cloud Foundry Application (cf push)
  • Kubernetes, using a helm chart
  • Docker, single container deploying all components
  • npm run start
  • Other (please specify below)

Backend (Jet Stream) Deployment type

  • Cloud Foundry Application (cf push)
  • Kubernetes, using a helm chart
  • Docker, single container deploying all components
  • Other (please specify below)

Expected behaviour

AppScan DAST scan should not flag Database Error Pattern Found vulnerability

Actual behaviour

AppScan DAST scan flags Database Error Pattern Found vulnerability

Steps to reproduce the behavior

AppScan DAST scans for Stratos URL https://ui.169.53.186.50.nip.io/pp/v1/proxy/v2/apps. The test result seems to indicate a vulnerability because the response contains SQL Server errors.

Which yields:

...Sec-Fetch-Mode: corsConnection: keep-aliveSec-Fetch-Site: same-originReferer: https://ui.169.53.186.50.nip.io/homeAccept: application/json, text/plain, */*Accept-Language: en-USSec-Fetch-Dest: emptyHTTP/1.1 200 OKConnection: keep-aliveAccess-Control-Allow-Credentials: truePragma: no-cacheAccess-Control-Allow-Origin: Vary: OriginContent-Length: 192X-Frame-Options: SAMEORIGINCache-Control: no-storeStrict-Transport-Security: max-age=15724800; includeSubDomainsDate: Wed, 10 Mar 2021 14:47:50 GMTContent-Type: text/plain; charset=utf-8{"t73XFqlpQugy2ywCJMheffz2HZU":{"error":{"statusCode":500,"status":"500 Internal Server Error"},"errorResponse":{"description":"Database error","error_code":"CF-DatabaseError","code":10011}}}...

Log output covering before error and any error statements

Insert log hereCopy

Detailed Description

Context

Possible Implementation

richard-cox commented

There is no SQL server error. Please be careful when creating issues using automated tools to first read what it produces and then apply some context.