Security Research & Verified Findings
A curated showcase of verified web application and API security findings. Every entry represents coordinated disclosure, structured root-cause analysis, and practical remediation guidance.
Broken Object Level Authorization (BOLA) in Multi-Tenant GraphQL Gateway
A sub-graph resolver failed to enforce contextual tenant ownership validations when resolving nested entity relationships across federated GraphQL gateways.
Technical Impact:
Allowed authenticated tenant users to retrieve sensitive metadata and resource references belonging to competing organizations by supplying arbitrary UUID keys.
Remediation Recommendation:
Implemented centralized field-level policy directives within schema resolvers and enforced database row-level authorization contexts prior to data layer querying.
Second-Order Blind SSRF via Asynchronous Webhook Validation Pipeline
Webhook endpoint URLs were parsed and checked during registration, but resolved asynchronously in background workers without re-validating DNS resolutions against internal cloud metadata endpoints.
Technical Impact:
Attackers could schedule webhook jobs that resolved to cloud metadata services (169.254.169.254) via DNS rebinding, potentially exposing ephemeral IAM credentials.
Remediation Recommendation:
Added strict egress firewall controls, disabled HTTP redirects in internal HTTP transport, and pinned socket connections directly to verified public IP addresses.
Mass Assignment Flaw in Enterprise Role Provisioning Endpoint
An internal user profile update PATCH endpoint deserialized unmapped JSON request properties directly into domain model entities without an explicit DTO filter.
Technical Impact:
Regular authenticated members could elevate privileges to organization admin by appending `"systemRole": "SUPER_ADMIN"` into the profile update payload.
Remediation Recommendation:
Enforced explicit Data Transfer Object (DTO) contracts with strict Jackson deserialization controls, discarding unapproved parameters.
Race Condition in Idempotency-Key Deduplication Cache
Idempotency key checks were split into separate GET and SET operations, leaving a 12ms concurrency window under high-frequency automated requests.
Technical Impact:
Could permit concurrent credit deduction bypasses or duplicate coupon redemptions when fired simultaneously across multiple distributed nodes.
Remediation Recommendation:
Replaced separate cache queries with an atomic `SET NX EX` command and distributed mutex locking on customer account IDs.