-
Type:
Bug
-
Status: Closed
-
Priority:
High
-
Resolution: Won't Do
-
Affects Version/s: None
-
Fix Version/s: None
-
Component/s: Integrations
-
Labels:None
-
Module:Platform - Security
-
Reported by:Harbinger
-
Item State:Stage QA - Production Deployment on Hold
-
Issue Importance:Q2
-
Dev Estimates:12
-
Code Reviewed By:Vijayendra Shinde
HTTP Method Fuzzing
An HTTP Method Fuzzing Scan attempts to use other HTTP verbs (methods) than those defined in an API. For instance, if you have defined GET and POST, it will send requests using the DELETE and PUT verbs, expecting an appropriate HTTP error response and reporting alerts if it doesn't receive it.
Sometimes, unexpected HTTP verbs can overwrite data on a server or get data that shouldn't be revealed to clients.
Alert Reported for PUT, PATCH, DELETE,POST methods:
Valhttps://workterra.atlassian.net/browse/NF-767#id HTTP Status Codes: Response status code:400 is not in acceptable list of status codes
APIs :
• Show Tours in Company
GET https://stage.workterra.net/api/tours/getTours
• Add Employee and Assign Tour
POST https://stage.workterra.net/api/employee/addEmployeeTour
