{"action":"opened","issue":{"url":"https://api.github.com/repos/humera987/FXLabs-Test-Automation/issues/34686","repository_url":"https://api.github.com/repos/humera987/FXLabs-Test-Automation","labels_url":"https://api.github.com/repos/humera987/FXLabs-Test-Automation/issues/34686/labels{/name}","comments_url":"https://api.github.com/repos/humera987/FXLabs-Test-Automation/issues/34686/comments","events_url":"https://api.github.com/repos/humera987/FXLabs-Test-Automation/issues/34686/events","html_url":"https://github.com/humera987/FXLabs-Test-Automation/issues/34686","id":425388428,"node_id":"MDU6SXNzdWU0MjUzODg0Mjg=","number":34686,"title":"Vulnerability [ABAC_Level7] : PUT:/api/v1/accounts/id","user":{"login":"humera987","id":40787463,"node_id":"MDQ6VXNlcjQwNzg3NDYz","avatar_url":"https://avatars1.githubusercontent.com/u/40787463?v=4","gravatar_id":"","url":"https://api.github.com/users/humera987","html_url":"https://github.com/humera987","followers_url":"https://api.github.com/users/humera987/followers","following_url":"https://api.github.com/users/humera987/following{/other_user}","gists_url":"https://api.github.com/users/humera987/gists{/gist_id}","starred_url":"https://api.github.com/users/humera987/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/humera987/subscriptions","organizations_url":"https://api.github.com/users/humera987/orgs","repos_url":"https://api.github.com/users/humera987/repos","events_url":"https://api.github.com/users/humera987/events{/privacy}","received_events_url":"https://api.github.com/users/humera987/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-03-26T12:28:16Z","updated_at":"2019-03-26T12:28:16Z","closed_at":null,"author_association":"OWNER","body":"Project  :  SanityTesting\n\nTemplate  :  ApiV1AccountsIdPutArrayaccountaccounttypegitlabusercDisallowAbact7\n\nRun Id  :  <html><a href=https://18.144.40.113/#/app/projects/8a80800669b9ccaf0169b9d051af01a7/jobs/8a80800669b9ccaf0169b9d057bc02d7/runs/8a80800669b9ccaf0169b9ece9fc512e>8a80800669b9ccaf0169b9ece9fc512e</a></html>\n\nJob  :  Default\n\nEnv  :  Default\n\nCategory  :  ABAC_Level7\n\nTags  :  [FX Top 10 - API Vulnerability, Data_Access_Control]\n\nSeverity  :  Major\n\nRegion  :  US_WEST\n\nResult  :  fail\n\nStatus Code  :  401\n\nHeaders  :  {WWW-Authenticate=[Basic realm=\"Realm\", Basic realm=\"Realm\"], X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Content-Length=[0], Date=[Tue, 26 Mar 2019 12:28:15 GMT]}\n\nEndpoint  :  http://13.56.210.25/api/v1/api/v1/accounts/\n\nRequest  :  \n[ {\n  \"accessKey\" : \"Y7YfFCi6\",\n  \"accountType\" : \"Microsoft_TFS_Git\",\n  \"allowedRegions\" : [ \"Y7YfFCi6\" ],\n  \"createdBy\" : \"\",\n  \"createdDate\" : \"\",\n  \"id\" : \"\",\n  \"inactive\" : false,\n  \"modifiedBy\" : \"\",\n  \"modifiedDate\" : \"\",\n  \"name\" : \"Y7YfFCi6\",\n  \"org\" : {\n    \"createdBy\" : \"\",\n    \"createdDate\" : \"\",\n    \"id\" : \"\",\n    \"inactive\" : false,\n    \"modifiedBy\" : \"\",\n    \"modifiedDate\" : \"\",\n    \"name\" : \"Y7YfFCi6\",\n    \"version\" : \"\"\n  },\n  \"prop1\" : \"Y7YfFCi6\",\n  \"prop2\" : \"Y7YfFCi6\",\n  \"prop3\" : \"Y7YfFCi6\",\n  \"region\" : \"Y7YfFCi6\",\n  \"secretKey\" : \"Y7YfFCi6\",\n  \"version\" : \"\"\n} ]\n\nResponse  :  \n\n\nLogs  :  \n2019-03-26 00:28:14  DEBUG [ArrayaccountAccounttypeGitlab6CreateUserAInitAbact7] : URL [http://13.56.210.25/api/v1/api/v1/accounts/batch]\n2019-03-26 00:28:14  DEBUG [ArrayaccountAccounttypeGitlab6CreateUserAInitAbact7] : Method [POST]\n2019-03-26 00:28:14  DEBUG [ArrayaccountAccounttypeGitlab6CreateUserAInitAbact7] : Request [[ {\n  \"accessKey\" : \"Ulg2ME9S\",\n  \"accountType\" : \"Microsoft_TFS_Git\",\n  \"allowedRegions\" : [ \"Ulg2ME9S\" ],\n  \"createdBy\" : \"\",\n  \"createdDate\" : \"\",\n  \"id\" : \"\",\n  \"inactive\" : false,\n  \"modifiedBy\" : \"\",\n  \"modifiedDate\" : \"\",\n  \"name\" : \"Ulg2ME9S\",\n  \"org\" : \"\",\n  \"prop1\" : \"Ulg2ME9S\",\n  \"prop2\" : \"Ulg2ME9S\",\n  \"prop3\" : \"Ulg2ME9S\",\n  \"region\" : \"Ulg2ME9S\",\n  \"secretKey\" : \"Ulg2ME9S\",\n  \"version\" : \"\"\n} ]]\n2019-03-26 00:28:14  DEBUG [ArrayaccountAccounttypeGitlab6CreateUserAInitAbact7] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic dXNlckFAZnhsYWJzLmlvOnVzZXJB]}]\n2019-03-26 00:28:14  DEBUG [ArrayaccountAccounttypeGitlab6CreateUserAInitAbact7] : Response []\n2019-03-26 00:28:14  DEBUG [ArrayaccountAccounttypeGitlab6CreateUserAInitAbact7] : Response-Headers [{WWW-Authenticate=[Basic realm=\"Realm\", Basic realm=\"Realm\"], X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Content-Length=[0], Date=[Tue, 26 Mar 2019 12:28:14 GMT]}]\n2019-03-26 00:28:14  DEBUG [ArrayaccountAccounttypeGitlab6CreateUserAInitAbact7] : StatusCode [401]\n2019-03-26 00:28:14  DEBUG [ArrayaccountAccounttypeGitlab6CreateUserAInitAbact7] : Time [505]\n2019-03-26 00:28:14  DEBUG [ArrayaccountAccounttypeGitlab6CreateUserAInitAbact7] : Size [0]\n2019-03-26 00:28:14  ERROR [null] : Assertion [@StatusCode == 200 OR @StatusCode == 201] resolved-to [401 == 200 OR 401 == 201] result [Failed]\n2019-03-26 00:28:14  DEBUG [ArrayaccountAccounttypeGitlab6CreateUserAInitAbact7_Headers] : Headers [{WWW-Authenticate=[Basic realm=\"Realm\", Basic realm=\"Realm\"], X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Content-Length=[0], Date=[Tue, 26 Mar 2019 12:28:14 GMT]}]\n2019-03-26 00:28:14  DEBUG [ArrayaccountAccounttypeGitlab6CreateUserAInitAbact7_Headers] : Headers [{WWW-Authenticate=[Basic realm=\"Realm\", Basic realm=\"Realm\"], X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Content-Length=[0], Date=[Tue, 26 Mar 2019 12:28:14 GMT]}]\n2019-03-26 00:28:14  DEBUG [ArrayaccountAccounttypeGitlab6CreateUserAInitAbact7_Headers[2]] : Headers [{WWW-Authenticate=[Basic realm=\"Realm\", Basic realm=\"Realm\"], X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Content-Length=[0], Date=[Tue, 26 Mar 2019 12:28:14 GMT]}]\n2019-03-26 00:28:14  DEBUG [ArrayaccountAccounttypeGitlab6CreateUserAInitAbact7_Headers[2]] : Headers [{WWW-Authenticate=[Basic realm=\"Realm\", Basic realm=\"Realm\"], X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Content-Length=[0], Date=[Tue, 26 Mar 2019 12:28:14 GMT]}]\n2019-03-26 00:28:16  DEBUG [ApiV1AccountsIdPutArrayaccountaccounttypegitlabusercDisallowAbact7] : URL [http://13.56.210.25/api/v1/api/v1/accounts/]\n2019-03-26 00:28:16  DEBUG [ApiV1AccountsIdPutArrayaccountaccounttypegitlabusercDisallowAbact7] : Method [PUT]\n2019-03-26 00:28:16  DEBUG [ApiV1AccountsIdPutArrayaccountaccounttypegitlabusercDisallowAbact7] : Request [[ {\n  \"accessKey\" : \"Y7YfFCi6\",\n  \"accountType\" : \"Microsoft_TFS_Git\",\n  \"allowedRegions\" : [ \"Y7YfFCi6\" ],\n  \"createdBy\" : \"\",\n  \"createdDate\" : \"\",\n  \"id\" : \"\",\n  \"inactive\" : false,\n  \"modifiedBy\" : \"\",\n  \"modifiedDate\" : \"\",\n  \"name\" : \"Y7YfFCi6\",\n  \"org\" : {\n    \"createdBy\" : \"\",\n    \"createdDate\" : \"\",\n    \"id\" : \"\",\n    \"inactive\" : false,\n    \"modifiedBy\" : \"\",\n    \"modifiedDate\" : \"\",\n    \"name\" : \"Y7YfFCi6\",\n    \"version\" : \"\"\n  },\n  \"prop1\" : \"Y7YfFCi6\",\n  \"prop2\" : \"Y7YfFCi6\",\n  \"prop3\" : \"Y7YfFCi6\",\n  \"region\" : \"Y7YfFCi6\",\n  \"secretKey\" : \"Y7YfFCi6\",\n  \"version\" : \"\"\n} ]]\n2019-03-26 00:28:16  DEBUG [ApiV1AccountsIdPutArrayaccountaccounttypegitlabusercDisallowAbact7] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic dXNlckNAZnhsYWJzLmlvOnVzZXJD]}]\n2019-03-26 00:28:16  DEBUG [ApiV1AccountsIdPutArrayaccountaccounttypegitlabusercDisallowAbact7] : Response []\n2019-03-26 00:28:16  DEBUG [ApiV1AccountsIdPutArrayaccountaccounttypegitlabusercDisallowAbact7] : Response-Headers [{WWW-Authenticate=[Basic realm=\"Realm\", Basic realm=\"Realm\"], X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Content-Length=[0], Date=[Tue, 26 Mar 2019 12:28:15 GMT]}]\n2019-03-26 00:28:16  DEBUG [ApiV1AccountsIdPutArrayaccountaccounttypegitlabusercDisallowAbact7] : StatusCode [401]\n2019-03-26 00:28:16  DEBUG [ApiV1AccountsIdPutArrayaccountaccounttypegitlabusercDisallowAbact7] : Time [1538]\n2019-03-26 00:28:16  DEBUG [ApiV1AccountsIdPutArrayaccountaccounttypegitlabusercDisallowAbact7] : Size [0]\n2019-03-26 00:28:16   INFO [ApiV1AccountsIdPutArrayaccountaccounttypegitlabusercDisallowAbact7] : Assertion [@StatusCode == 401 OR @StatusCode == 403] resolved-to [401 == 401 OR 401 == 403] result [Passed]\n2019-03-26 00:28:16  DEBUG [ApiV1AccountsIdDeleteArrayaccountaccounttypegitlababact7] : URL [http://13.56.210.25/api/v1/api/v1/accounts/]\n2019-03-26 00:28:16  DEBUG [ApiV1AccountsIdDeleteArrayaccountaccounttypegitlababact7] : Method [DELETE]\n2019-03-26 00:28:16  DEBUG [ApiV1AccountsIdDeleteArrayaccountaccounttypegitlababact7] : Request [null]\n2019-03-26 00:28:16  DEBUG [ApiV1AccountsIdDeleteArrayaccountaccounttypegitlababact7] : Request-Headers [{Content-Type=[application/json], Accept=[application/json], Authorization=[Basic dXNlckFAZnhsYWJzLmlvOnVzZXJB]}]\n2019-03-26 00:28:16  DEBUG [ApiV1AccountsIdDeleteArrayaccountaccounttypegitlababact7] : Response []\n2019-03-26 00:28:16  DEBUG [ApiV1AccountsIdDeleteArrayaccountaccounttypegitlababact7] : Response-Headers [{WWW-Authenticate=[Basic realm=\"Realm\", Basic realm=\"Realm\"], X-Content-Type-Options=[nosniff], X-XSS-Protection=[1; mode=block], Cache-Control=[no-cache, no-store, max-age=0, must-revalidate], Pragma=[no-cache], Expires=[0], X-Frame-Options=[DENY], Content-Length=[0], Date=[Tue, 26 Mar 2019 12:28:16 GMT]}]\n2019-03-26 00:28:16  DEBUG [ApiV1AccountsIdDeleteArrayaccountaccounttypegitlababact7] : StatusCode [401]\n2019-03-26 00:28:16  DEBUG [ApiV1AccountsIdDeleteArrayaccountaccounttypegitlababact7] : Time [445]\n2019-03-26 00:28:16  DEBUG [ApiV1AccountsIdDeleteArrayaccountaccounttypegitlababact7] : Size [0]\n2019-03-26 00:28:16  ERROR [null] : Assertion [@StatusCode == 200] resolved-to [401 == 200] result [Failed]\n\n--- FX Bot ---"}}
{"actor":{"display_login":"humera987"}}