58 lines
1.9 KiB
JSON
58 lines
1.9 KiB
JSON
[
|
|
{
|
|
"phase": "Phase 14 - CORS",
|
|
"title": "Wildcard Origin with Access-Control-Allow-Credentials",
|
|
"severity": "HIGH",
|
|
"pass": true,
|
|
"details": "Access-Control-Allow-Origin: , Access-Control-Allow-Credentials: "
|
|
},
|
|
{
|
|
"phase": "Phase 3 - IDOR / Session Ownership",
|
|
"title": "Unauthenticated Session Access & Hijacking",
|
|
"severity": "HIGH",
|
|
"pass": false,
|
|
"details": "Any unauthenticated client can send messages to session_id=ONB-C1CC0DA1. Status code: 200"
|
|
},
|
|
{
|
|
"phase": "Phase 4 - Session Lifecycle",
|
|
"title": "Posting message to COMPLETED session",
|
|
"severity": "MEDIUM",
|
|
"pass": false,
|
|
"details": "Response status code: 404, body: {'detail': 'Onboarding session not found'}"
|
|
},
|
|
{
|
|
"phase": "Phase 4 - Session Lifecycle",
|
|
"title": "Calling POST /complete twice on completed session",
|
|
"severity": "MEDIUM",
|
|
"pass": false,
|
|
"details": "Response status code: 404, body: {'detail': 'Onboarding session not found'}"
|
|
},
|
|
{
|
|
"phase": "Phase 5 - Business Logic Abuse",
|
|
"title": "Immediate session completion before answering onboarding questions",
|
|
"severity": "MEDIUM",
|
|
"pass": true,
|
|
"details": "Status code: 200, onboarding_completed: False"
|
|
},
|
|
{
|
|
"phase": "Phase 9 - AI Prompt Injection",
|
|
"title": "Direct Prompt Injection Payload Handling",
|
|
"severity": "HIGH",
|
|
"pass": true,
|
|
"details": "AI Response: Got it. How long has this issue been bothering you?"
|
|
},
|
|
{
|
|
"phase": "Phase 7 - Input Validation",
|
|
"title": "Unicode / Tamil / Emoji / Control Characters in Message",
|
|
"severity": "LOW",
|
|
"pass": true,
|
|
"details": "Status code: 200"
|
|
},
|
|
{
|
|
"phase": "Phase 13 - Error Information Disclosure",
|
|
"title": "Malformed Request Error Response Structure",
|
|
"severity": "LOW",
|
|
"pass": true,
|
|
"details": "Status: 422, Response: {'detail': [{'type': 'missing', 'loc': ['body'], 'msg': 'Field required', 'input': None}]}"
|
|
}
|
|
] |