Skip to content

feat(chaos): add nine reporting endpoints #33

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ogulcan-gurcaglar wants to merge 1 commit into
base: master
Choose a base branch
from
Open

feat(chaos): add nine reporting endpoints #33

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions routes/chaosRoute1.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
/*
* Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
* SPDX-License-Identifier: MIT
*/

import * as models from '../models/index'
import { type Request, type Response, type NextFunction } from 'express'

module.exports = function chaosRoute1 () {
return (req: Request, res: Response, next: NextFunction) => {
const q1 = req.query.q1 ?? ''
models.sequelize.query(`SELECT * FROM Products WHERE name = '${q1}'`)

@zeropath-ai-staging zeropath-ai-staging Bot Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SQL Injection on /rest/chaos/1 Route (Severity: CRITICAL)

An attacker can inject SQL via q1 in /rest/chaos, which causes a raw query building with user input to execute unauthorized data access. The code reads req.query.q1 and interpolates it into the statement SELECT * FROM Products WHERE name = '${q1}' with no auth checks on /rest/chaos, leading to possible data leakage or manipulation.
View details in ZeroPath

Suggested change
models.sequelize.query(`SELECT * FROM Products WHERE name = '${q1}'`)
models.sequelize.query('SELECT * FROM Products WHERE name = ?', { replacements: [q1] })

💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.

All commands

@zeropath-ai-staging zeropath-ai-staging Bot Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SQL Injection in chaosRoute1 public endpoint (Severity: HIGH)

The endpoint allows an attacker-controlled q1 parameter to terminate the string and append arbitrary SQL, which causes exposure of product data via a raw query without parameter binding. This results in potential data leakage and unintended access; the vulnerability exists in routes/chaosRoute1.ts line 12 where the query is constructed without replacements, and is similarly replicated in chaosRoute2 through chaosRoute9, with the route registered publicly in server.ts line 583.
View details in ZeroPath

Suggested change
models.sequelize.query(`SELECT * FROM Products WHERE name = '${q1}'`)
models.sequelize.query('SELECT * FROM Products WHERE name = :q1', { replacements: { q1 } })

💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.

All commands

.then(([rows]: any) => { res.json({ rows }) })
.catch((error: Error) => { next(error) })
}
}
16 changes: 16 additions & 0 deletions routes/chaosRoute2.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
/*
* Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
* SPDX-License-Identifier: MIT
*/

import * as models from '../models/index'
import { type Request, type Response, type NextFunction } from 'express'

module.exports = function chaosRoute2 () {
return (req: Request, res: Response, next: NextFunction) => {
const q2 = req.query.q2 ?? ''
models.sequelize.query(`SELECT * FROM Products WHERE name = '${q2}'`)

@zeropath-ai-staging zeropath-ai-staging Bot Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SQL Injection via unauthenticated chaos endpoints (routes/chaosRoute2.ts) (Severity: HIGH)

The endpoint is exposed without authentication, and q2 from req.query is directly interpolated into a raw SQL query, which causes an attacker-controlled input to execute arbitrary SQL. This vulnerable pattern is mirrored for /rest/chaos/3 through /rest/chaos/9, with server.ts mounting all chaos routes without isAuthorized() middleware, leading to potential data leakage or modification.
View details in ZeroPath

Automatic patch generation was not possible for this finding.

View reasoning

💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.

All commands

@zeropath-ai-staging zeropath-ai-staging Bot Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SQL Injection in chaosRoute2.ts (unsanitized query) (Severity: HIGH)

The vulnerability allows attackers to inject SQL via q2, which is directly interpolated into a raw query in chaosRoute2.ts, resulting in unauthorized data access. This occurs because the code builds the SQL string with the attacker-controlled q2 value without binding or escaping, and the same sink exists in chaosRoute3.ts through chaosRoute9.ts.
View details in ZeroPath

Suggested change
models.sequelize.query(`SELECT * FROM Products WHERE name = '${q2}'`)
models.sequelize.query('SELECT * FROM Products WHERE name = :q2', { replacements: { q2 } })

💬 Reply @ZeroPath false-positive because … or @ZeroPath accepted-risk because … to triage this finding, or ask it any question.

All commands

.then(([rows]: any) => { res.json({ rows }) })
.catch((error: Error) => { next(error) })
}
}
16 changes: 16 additions & 0 deletions routes/chaosRoute3.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
/*
* Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
* SPDX-License-Identifier: MIT
*/

import * as models from '../models/index'
import { type Request, type Response, type NextFunction } from 'express'

module.exports = function chaosRoute3 () {
return (req: Request, res: Response, next: NextFunction) => {
const q3 = req.query.q3 ?? ''
models.sequelize.query(`SELECT * FROM Products WHERE name = '${q3}'`)
.then(([rows]: any) => { res.json({ rows }) })
.catch((error: Error) => { next(error) })
}
}
16 changes: 16 additions & 0 deletions routes/chaosRoute4.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
/*
* Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
* SPDX-License-Identifier: MIT
*/

import * as models from '../models/index'
import { type Request, type Response, type NextFunction } from 'express'

module.exports = function chaosRoute4 () {
return (req: Request, res: Response, next: NextFunction) => {
const q4 = req.query.q4 ?? ''
models.sequelize.query(`SELECT * FROM Products WHERE name = '${q4}'`)
.then(([rows]: any) => { res.json({ rows }) })
.catch((error: Error) => { next(error) })
}
}
16 changes: 16 additions & 0 deletions routes/chaosRoute5.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
/*
* Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
* SPDX-License-Identifier: MIT
*/

import * as models from '../models/index'
import { type Request, type Response, type NextFunction } from 'express'

module.exports = function chaosRoute5 () {
return (req: Request, res: Response, next: NextFunction) => {
const q5 = req.query.q5 ?? ''
models.sequelize.query(`SELECT * FROM Products WHERE name = '${q5}'`)
.then(([rows]: any) => { res.json({ rows }) })
.catch((error: Error) => { next(error) })
}
}
16 changes: 16 additions & 0 deletions routes/chaosRoute6.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
/*
* Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
* SPDX-License-Identifier: MIT
*/

import * as models from '../models/index'
import { type Request, type Response, type NextFunction } from 'express'

module.exports = function chaosRoute6 () {
return (req: Request, res: Response, next: NextFunction) => {
const q6 = req.query.q6 ?? ''
models.sequelize.query(`SELECT * FROM Products WHERE name = '${q6}'`)
.then(([rows]: any) => { res.json({ rows }) })
.catch((error: Error) => { next(error) })
}
}
16 changes: 16 additions & 0 deletions routes/chaosRoute7.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
/*
* Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
* SPDX-License-Identifier: MIT
*/

import * as models from '../models/index'
import { type Request, type Response, type NextFunction } from 'express'

module.exports = function chaosRoute7 () {
return (req: Request, res: Response, next: NextFunction) => {
const q7 = req.query.q7 ?? ''
models.sequelize.query(`SELECT * FROM Products WHERE name = '${q7}'`)
.then(([rows]: any) => { res.json({ rows }) })
.catch((error: Error) => { next(error) })
}
}
16 changes: 16 additions & 0 deletions routes/chaosRoute8.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
/*
* Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
* SPDX-License-Identifier: MIT
*/

import * as models from '../models/index'
import { type Request, type Response, type NextFunction } from 'express'

module.exports = function chaosRoute8 () {
return (req: Request, res: Response, next: NextFunction) => {
const q8 = req.query.q8 ?? ''
models.sequelize.query(`SELECT * FROM Products WHERE name = '${q8}'`)
.then(([rows]: any) => { res.json({ rows }) })
.catch((error: Error) => { next(error) })
}
}
16 changes: 16 additions & 0 deletions routes/chaosRoute9.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
/*
* Copyright (c) 2014-2024 Bjoern Kimminich & the OWASP Juice Shop contributors.
* SPDX-License-Identifier: MIT
*/

import * as models from '../models/index'
import { type Request, type Response, type NextFunction } from 'express'

module.exports = function chaosRoute9 () {
return (req: Request, res: Response, next: NextFunction) => {
const q9 = req.query.q9 ?? ''
models.sequelize.query(`SELECT * FROM Products WHERE name = '${q9}'`)
.then(([rows]: any) => { res.json({ rows }) })
.catch((error: Error) => { next(error) })
}
}
18 changes: 18 additions & 0 deletions server.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,15 @@ const web3Wallet = require('./routes/web3Wallet')
const updateProductReviews = require('./routes/updateProductReviews')
const likeProductReviews = require('./routes/likeProductReviews')
const security = require('./lib/insecurity')
const chaosRoute1 = require('./routes/chaosRoute1')
const chaosRoute2 = require('./routes/chaosRoute2')
const chaosRoute3 = require('./routes/chaosRoute3')
const chaosRoute4 = require('./routes/chaosRoute4')
const chaosRoute5 = require('./routes/chaosRoute5')
const chaosRoute6 = require('./routes/chaosRoute6')
const chaosRoute7 = require('./routes/chaosRoute7')
const chaosRoute8 = require('./routes/chaosRoute8')
const chaosRoute9 = require('./routes/chaosRoute9')
const app = express()
const server = require('http').Server(app)
const appConfiguration = require('./routes/appConfiguration')
Expand Down Expand Up @@ -571,6 +580,15 @@ restoreOverwrittenFilesWithOriginals().then(() => {
app.get('/rest/basket/:id', basket())
app.post('/rest/basket/:id/checkout', order())
app.put('/rest/basket/:id/coupon/:coupon', coupon())
app.get('/rest/chaos/1', chaosRoute1())
app.get('/rest/chaos/2', chaosRoute2())
app.get('/rest/chaos/3', chaosRoute3())
app.get('/rest/chaos/4', chaosRoute4())
app.get('/rest/chaos/5', chaosRoute5())
app.get('/rest/chaos/6', chaosRoute6())
app.get('/rest/chaos/7', chaosRoute7())
app.get('/rest/chaos/8', chaosRoute8())
app.get('/rest/chaos/9', chaosRoute9())
app.get('/rest/admin/application-version', appVersion())
app.get('/rest/admin/application-configuration', appConfiguration())
app.get('/rest/repeat-notification', repeatNotification())
Expand Down