-
Type:
Bug
-
Status:
In LB Testing
-
Priority:
High
-
Resolution:
Unresolved
-
Affects Version/s:
None
-
Fix Version/s:
None
-
-
-
-
-
-
Module:
Platform
- Security
-
-
Item State:
Development
- On Hold
-
[Security] All Company - EE Login - Enroll Now - Request parameters values on Enroll Now page get altered and can be saved successfully.
Environment : Azure
Login : Employee
Company : Beta Security Test
Employee : Saba Abai / 164215 / Password1@
Tool : ZAP
Replication Steps:
1. Login as Employee
2. Start traversing employee self serve mode through OE/New Hire/Employee Dashboard -> Enroll Now
3. Go to Enroll Now page
4. Go to any plan which is already enrolled or enroll in new plan.
5. Tamper the request parameters like Coverage Amount, Costs for enroll now action.
6. Save the updated values.
7. Verify the Confirmation Statement, Enrollment Summary, Enrollment reports
Real life scenarios those are possible.
1. Employee can increase the Coverage amount keeping the cost (Premium) same.
2. Employee can increase Coverage amount and decrease cost (Premium).
3. Employee can keep same Coverage amount for decreased cost (Premium).
CC : Rakesh RoySamirBharti SatputeVijay SiddhaSatyaSachin HingoleHrishikesh DeshpandeGaurav SodaniNidhi Kaulshyam sharma
- relates to
-
NF-2714
Vulnerability Assessment and Penetration Testing for Workterra on Azure US environment.
-
-
To Do
{"report":{"apdex":1,"isInitial":true,"journeyId":"d7e091b3-ff99-4da2-8ed7-7688f29e022e","key":"jira.project.issue.view-issue","navigationType":0,"readyForUser":914.0999999940395,"redirectCount":0,"resourceLoadedEnd":800.5999999940395,"resourceLoadedStart":195.40000000596046,"resourceTiming":[{"duration":209,"initiatorType":"link","name":"https://jira.workterra.net/s/3003653444a1e1a85555cab7dcfb3a21-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/css/_super/batch.css","startTime":195.40000000596046,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":195.40000000596046,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":404.40000000596046,"responseStart":0,"secureConnectionStart":0},{"duration":208.70000000298023,"initiatorType":"link","name":"https://jira.workterra.net/s/dd6a0911920485696ac20493290df627-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/css/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&richediton=true","startTime":195.70000000298023,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":195.70000000298023,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":404.40000000596046,"responseStart":0,"secureConnectionStart":0},{"duration":208.6000000089407,"initiatorType":"link","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.css","startTime":195.79999999701977,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":195.79999999701977,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":404.40000000596046,"responseStart":0,"secureConnectionStart":0},{"duration":209.59999999403954,"initiatorType":"link","name":"https://jira.workterra.net/s/bd548f27bbf8f278bd83b60dd3284ed8-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static-adgs/jira.webresources:global-static-adgs.css","startTime":195.90000000596046,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":195.90000000596046,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":405.5,"responseStart":0,"secureConnectionStart":0},{"duration":210,"initiatorType":"link","name":"https://jira.workterra.net/s/70725731a158a7140f19ddbd4201ba27-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static/jira.webresources:global-static.css","startTime":196,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":196,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":406,"responseStart":0,"secureConnectionStart":0},{"duration":224.5,"initiatorType":"script","name":"https://jira.workterra.net/s/f2623af22c15df767ec6ff268ae0b8bd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/js/_super/batch.js?locale=en-US","startTime":196,"connectEnd":196,"connectStart":196,"domainLookupEnd":196,"domainLookupStart":196,"fetchStart":196,"redirectEnd":0,"redirectStart":0,"requestStart":196,"responseEnd":420.5,"responseStart":420.40000000596046,"secureConnectionStart":196},{"duration":296.29999999701977,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/4.1.5/_/download/resources/com.atlassian.plugins.atlassian-chaperone:hotspot-tour/hotspot-tour.js?batch=false&locale=en-US","startTime":196.20000000298023,"connectEnd":196.20000000298023,"connectStart":196.20000000298023,"domainLookupEnd":196.20000000298023,"domainLookupStart":196.20000000298023,"fetchStart":196.20000000298023,"redirectEnd":0,"redirectStart":0,"requestStart":196.20000000298023,"responseEnd":492.5,"responseStart":492.5,"secureConnectionStart":196.20000000298023},{"duration":293.20000000298023,"initiatorType":"script","name":"https://jira.workterra.net/s/6ce676f2a5bcc9651cef6e7956f05def-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/js/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":196.20000000298023,"connectEnd":196.20000000298023,"connectStart":196.20000000298023,"domainLookupEnd":196.20000000298023,"domainLookupStart":196.20000000298023,"fetchStart":196.20000000298023,"redirectEnd":0,"redirectStart":0,"requestStart":196.20000000298023,"responseEnd":489.40000000596046,"responseStart":489.29999999701977,"secureConnectionStart":196.20000000298023},{"duration":297.09999999403954,"initiatorType":"script","name":"https://jira.workterra.net/s/6aa3fcf1fac5fd551eee0b69077524e6-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/aae1242f5fc81cc6a5bb8bc963ccda29/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en-US","startTime":196.40000000596046,"connectEnd":196.40000000596046,"connectStart":196.40000000596046,"domainLookupEnd":196.40000000596046,"domainLookupStart":196.40000000596046,"fetchStart":196.40000000596046,"redirectEnd":0,"redirectStart":0,"requestStart":196.40000000596046,"responseEnd":493.5,"responseStart":493.5,"secureConnectionStart":196.40000000596046},{"duration":297.40000000596046,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":196.5,"connectEnd":196.5,"connectStart":196.5,"domainLookupEnd":196.5,"domainLookupStart":196.5,"fetchStart":196.5,"redirectEnd":0,"redirectStart":0,"requestStart":196.5,"responseEnd":493.90000000596046,"responseStart":493.90000000596046,"secureConnectionStart":196.5},{"duration":297.70000000298023,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":196.59999999403954,"connectEnd":196.59999999403954,"connectStart":196.59999999403954,"domainLookupEnd":196.59999999403954,"domainLookupStart":196.59999999403954,"fetchStart":196.59999999403954,"redirectEnd":0,"redirectStart":0,"requestStart":196.59999999403954,"responseEnd":494.29999999701977,"responseStart":494.29999999701977,"secureConnectionStart":196.59999999403954},{"duration":297.90000000596046,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.js?locale=en-US","startTime":196.79999999701977,"connectEnd":196.79999999701977,"connectStart":196.79999999701977,"domainLookupEnd":196.79999999701977,"domainLookupStart":196.79999999701977,"fetchStart":196.79999999701977,"redirectEnd":0,"redirectStart":0,"requestStart":196.79999999701977,"responseEnd":494.70000000298023,"responseStart":494.70000000298023,"secureConnectionStart":196.79999999701977},{"duration":298.29999999701977,"initiatorType":"link","name":"https://jira.workterra.net/s/05c862146699bb029ceb0a489075e63b-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/bcd66e9a133a1b9f5fd14b56841e1c5b/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":197,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":197,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":495.29999999701977,"responseStart":0,"secureConnectionStart":0},{"duration":298,"initiatorType":"script","name":"https://jira.workterra.net/rest/api/1.0/shortcuts/805012/81da1c7492d7ee698ae1cc31902498d9/shortcuts.js?context=issuenavigation&context=issueaction","startTime":197.09999999403954,"connectEnd":197.09999999403954,"connectStart":197.09999999403954,"domainLookupEnd":197.09999999403954,"domainLookupStart":197.09999999403954,"fetchStart":197.09999999403954,"redirectEnd":0,"redirectStart":0,"requestStart":197.09999999403954,"responseEnd":495.09999999403954,"responseStart":495.09999999403954,"secureConnectionStart":197.09999999403954},{"duration":298.29999999701977,"initiatorType":"link","name":"https://jira.workterra.net/s/9095228fa10daa2d3e3d7d5760c95e91-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.css?jira.create.linked.issue=true&richediton=true","startTime":197.20000000298023,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":197.20000000298023,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":495.5,"responseStart":0,"secureConnectionStart":0},{"duration":298.29999999701977,"initiatorType":"script","name":"https://jira.workterra.net/s/c19a1b46e985d7fb85efaf27c8febfdd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.js?jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":197.29999999701977,"connectEnd":197.29999999701977,"connectStart":197.29999999701977,"domainLookupEnd":197.29999999701977,"domainLookupStart":197.29999999701977,"fetchStart":197.29999999701977,"redirectEnd":0,"redirectStart":0,"requestStart":197.29999999701977,"responseEnd":495.59999999403954,"responseStart":495.59999999403954,"secureConnectionStart":197.29999999701977},{"duration":601.3999999910593,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":198.90000000596046,"connectEnd":198.90000000596046,"connectStart":198.90000000596046,"domainLookupEnd":198.90000000596046,"domainLookupStart":198.90000000596046,"fetchStart":198.90000000596046,"redirectEnd":0,"redirectStart":0,"requestStart":198.90000000596046,"responseEnd":800.2999999970198,"responseStart":800.2999999970198,"secureConnectionStart":198.90000000596046},{"duration":601.6999999880791,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":198.90000000596046,"connectEnd":198.90000000596046,"connectStart":198.90000000596046,"domainLookupEnd":198.90000000596046,"domainLookupStart":198.90000000596046,"fetchStart":198.90000000596046,"redirectEnd":0,"redirectStart":0,"requestStart":198.90000000596046,"responseEnd":800.5999999940395,"responseStart":800.5999999940395,"secureConnectionStart":198.90000000596046},{"duration":165.59999999403954,"initiatorType":"xmlhttprequest","name":"https://jira.workterra.net/rest/webResources/1.0/resources","startTime":632,"connectEnd":632,"connectStart":632,"domainLookupEnd":632,"domainLookupStart":632,"fetchStart":632,"redirectEnd":0,"redirectStart":0,"requestStart":632,"responseEnd":797.5999999940395,"responseStart":797.5999999940395,"secureConnectionStart":632}],"threshold":1000,"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":19,"responseStart":187,"responseEnd":190,"domLoading":193,"domInteractive":1083,"domContentLoadedEventStart":1083,"domContentLoadedEventEnd":1169,"domComplete":1383,"loadEventStart":1383,"loadEventEnd":1386,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[],"measures":[],"correlationId":"b643f8004f5adf","effectiveType":"4g","downlink":10,"rtt":0,"serverDuration":140,"dbReadsTimeInMs":80,"dbConnsTimeInMs":81,"applicationHash":"156decd7d2b4272533aa6cefc8294af635e1da97","experiments":[]}}