-
Type:
Bug
-
Status:
Closed
-
Priority:
Critical
-
Resolution:
Done
-
Affects Version/s:
None
-
Fix Version/s:
None
-
-
-
-
Module:
BenAdmin
- Security
-
-
Item State:
Production Complete
-
Issue Importance:
Must Have
Praetorian initially detected a SQL injection vulnerability after submitting a variety of malicious input
parameters to the GetEmployees endpoint. Praetorian used SQL injection payloads that caused the
application to demonstrate a noticeable difference in response time depending on the results of the
provided SQL query.
Page Name: Search Employee
Information Recovered:
SQL Server version number, Database version, Server name
System should not disclose this information to user.
{"report":{"apdex":1,"isInitial":true,"journeyId":"e6f1bef8-a27a-4a28-b438-ea252d0c6d0a","key":"jira.project.issue.view-issue","navigationType":0,"readyForUser":575.6999998092651,"redirectCount":0,"resourceLoadedEnd":477,"resourceLoadedStart":87.80000019073486,"resourceTiming":[{"duration":9.5,"initiatorType":"link","name":"https://jira.workterra.net/s/3003653444a1e1a85555cab7dcfb3a21-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/css/_super/batch.css","startTime":87.80000019073486,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":87.80000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":97.30000019073486,"responseStart":0,"secureConnectionStart":0},{"duration":9.700000762939453,"initiatorType":"link","name":"https://jira.workterra.net/s/dd6a0911920485696ac20493290df627-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/css/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&richediton=true","startTime":88.09999942779541,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":88.09999942779541,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":97.80000019073486,"responseStart":0,"secureConnectionStart":0},{"duration":10,"initiatorType":"link","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.css","startTime":88.30000019073486,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":88.30000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":98.30000019073486,"responseStart":0,"secureConnectionStart":0},{"duration":10.199999809265137,"initiatorType":"link","name":"https://jira.workterra.net/s/bd548f27bbf8f278bd83b60dd3284ed8-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static-adgs/jira.webresources:global-static-adgs.css","startTime":88.5,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":88.5,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":98.69999980926514,"responseStart":0,"secureConnectionStart":0},{"duration":10.5,"initiatorType":"link","name":"https://jira.workterra.net/s/70725731a158a7140f19ddbd4201ba27-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static/jira.webresources:global-static.css","startTime":88.59999942779541,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":88.59999942779541,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":99.09999942779541,"responseStart":0,"secureConnectionStart":0},{"duration":61.59999942779541,"initiatorType":"script","name":"https://jira.workterra.net/s/f2623af22c15df767ec6ff268ae0b8bd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/js/_super/batch.js?locale=en-US","startTime":88.80000019073486,"connectEnd":88.80000019073486,"connectStart":88.80000019073486,"domainLookupEnd":88.80000019073486,"domainLookupStart":88.80000019073486,"fetchStart":88.80000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":88.80000019073486,"responseEnd":150.39999961853027,"responseStart":150.39999961853027,"secureConnectionStart":88.80000019073486},{"duration":100.5,"initiatorType":"script","name":"https://jira.workterra.net/s/6ce676f2a5bcc9651cef6e7956f05def-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/js/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":89,"connectEnd":89,"connectStart":89,"domainLookupEnd":89,"domainLookupStart":89,"fetchStart":89,"redirectEnd":0,"redirectStart":0,"requestStart":89,"responseEnd":189.5,"responseStart":189.5,"secureConnectionStart":89},{"duration":103.5,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/4.1.5/_/download/resources/com.atlassian.plugins.atlassian-chaperone:hotspot-tour/hotspot-tour.js?batch=false&locale=en-US","startTime":89.09999942779541,"connectEnd":89.09999942779541,"connectStart":89.09999942779541,"domainLookupEnd":89.09999942779541,"domainLookupStart":89.09999942779541,"fetchStart":89.09999942779541,"redirectEnd":0,"redirectStart":0,"requestStart":89.09999942779541,"responseEnd":192.5999994277954,"responseStart":192.5999994277954,"secureConnectionStart":89.09999942779541},{"duration":103.79999923706055,"initiatorType":"script","name":"https://jira.workterra.net/s/6aa3fcf1fac5fd551eee0b69077524e6-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/aae1242f5fc81cc6a5bb8bc963ccda29/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en-US","startTime":89.30000019073486,"connectEnd":89.30000019073486,"connectStart":89.30000019073486,"domainLookupEnd":89.30000019073486,"domainLookupStart":89.30000019073486,"fetchStart":89.30000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":89.30000019073486,"responseEnd":193.0999994277954,"responseStart":193.0999994277954,"secureConnectionStart":89.30000019073486},{"duration":103.89999961853027,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":89.5,"connectEnd":89.5,"connectStart":89.5,"domainLookupEnd":89.5,"domainLookupStart":89.5,"fetchStart":89.5,"redirectEnd":0,"redirectStart":0,"requestStart":89.5,"responseEnd":193.39999961853027,"responseStart":193.39999961853027,"secureConnectionStart":89.5},{"duration":104.19999980926514,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":89.69999980926514,"connectEnd":89.69999980926514,"connectStart":89.69999980926514,"domainLookupEnd":89.69999980926514,"domainLookupStart":89.69999980926514,"fetchStart":89.69999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":89.69999980926514,"responseEnd":193.89999961853027,"responseStart":193.89999961853027,"secureConnectionStart":89.69999980926514},{"duration":104.5,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.js?locale=en-US","startTime":89.80000019073486,"connectEnd":89.80000019073486,"connectStart":89.80000019073486,"domainLookupEnd":89.80000019073486,"domainLookupStart":89.80000019073486,"fetchStart":89.80000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":89.80000019073486,"responseEnd":194.30000019073486,"responseStart":194.30000019073486,"secureConnectionStart":89.80000019073486},{"duration":203.10000038146973,"initiatorType":"link","name":"https://jira.workterra.net/s/05c862146699bb029ceb0a489075e63b-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/bcd66e9a133a1b9f5fd14b56841e1c5b/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":90.09999942779541,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":90.09999942779541,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":293.19999980926514,"responseStart":0,"secureConnectionStart":0},{"duration":104.70000076293945,"initiatorType":"script","name":"https://jira.workterra.net/rest/api/1.0/shortcuts/805012/a664c2c06e52d83566c477b9899c262e/shortcuts.js?context=issuenavigation&context=issueaction","startTime":90.09999942779541,"connectEnd":90.09999942779541,"connectStart":90.09999942779541,"domainLookupEnd":90.09999942779541,"domainLookupStart":90.09999942779541,"fetchStart":90.09999942779541,"redirectEnd":0,"redirectStart":0,"requestStart":90.09999942779541,"responseEnd":194.80000019073486,"responseStart":194.80000019073486,"secureConnectionStart":90.09999942779541},{"duration":203.0999994277954,"initiatorType":"link","name":"https://jira.workterra.net/s/9095228fa10daa2d3e3d7d5760c95e91-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.css?jira.create.linked.issue=true&richediton=true","startTime":90.30000019073486,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":90.30000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":293.3999996185303,"responseStart":0,"secureConnectionStart":0},{"duration":104.80000019073486,"initiatorType":"script","name":"https://jira.workterra.net/s/c19a1b46e985d7fb85efaf27c8febfdd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.js?jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":90.5,"connectEnd":90.5,"connectStart":90.5,"domainLookupEnd":90.5,"domainLookupStart":90.5,"fetchStart":90.5,"redirectEnd":0,"redirectStart":0,"requestStart":90.5,"responseEnd":195.30000019073486,"responseStart":195.30000019073486,"secureConnectionStart":90.5},{"duration":241.39999961853027,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":91.30000019073486,"connectEnd":91.30000019073486,"connectStart":91.30000019073486,"domainLookupEnd":91.30000019073486,"domainLookupStart":91.30000019073486,"fetchStart":91.30000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":91.30000019073486,"responseEnd":332.69999980926514,"responseStart":332.69999980926514,"secureConnectionStart":91.30000019073486},{"duration":265.5,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":91.39999961853027,"connectEnd":91.39999961853027,"connectStart":91.39999961853027,"domainLookupEnd":91.39999961853027,"domainLookupStart":91.39999961853027,"fetchStart":91.39999961853027,"redirectEnd":0,"redirectStart":0,"requestStart":91.39999961853027,"responseEnd":356.8999996185303,"responseStart":356.8999996185303,"secureConnectionStart":91.39999961853027},{"duration":26.399999618530273,"initiatorType":"xmlhttprequest","name":"https://jira.workterra.net/rest/webResources/1.0/resources","startTime":320,"connectEnd":320,"connectStart":320,"domainLookupEnd":320,"domainLookupStart":320,"fetchStart":320,"redirectEnd":0,"redirectStart":0,"requestStart":320,"responseEnd":346.3999996185303,"responseStart":346.3999996185303,"secureConnectionStart":320},{"duration":48.40000057220459,"initiatorType":"link","name":"https://jira.workterra.net/s/d90c1473b7a13a8252a5b30389eb7242-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/b20f16540fbe06e1db6adb796067f0a5/_/download/contextbatch/css/jira.rich.editor.api,jira.project.sidebar,jira.rich.editor,com.atlassian.jira.plugins.jira-development-integration-plugin:0,-_super,-jira.view.issue,-jira.global,-atl.general,-com.atlassian.jira.projects.sidebar.init,-project.issue.navigator/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&richediton=true","startTime":428.5999994277954,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":428.5999994277954,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":477,"responseStart":0,"secureConnectionStart":0},{"duration":26,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/be9ff0efea54a6453d2ac60b92912a09/_/download/contextbatch/js/browser-metrics-plugin.contrib,-_super,-project.issue.navigator,-jira.view.issue,-atl.general/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&richediton=true","startTime":429.5999994277954,"connectEnd":429.5999994277954,"connectStart":429.5999994277954,"domainLookupEnd":429.5999994277954,"domainLookupStart":429.5999994277954,"fetchStart":429.5999994277954,"redirectEnd":0,"redirectStart":0,"requestStart":429.5999994277954,"responseEnd":455.5999994277954,"responseStart":455.5999994277954,"secureConnectionStart":429.5999994277954},{"duration":37.89999961853027,"initiatorType":"script","name":"https://jira.workterra.net/s/e9dc30f38cc02b407dcfcbd09fa3799e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/b20f16540fbe06e1db6adb796067f0a5/_/download/contextbatch/js/jira.rich.editor.api,jira.project.sidebar,jira.rich.editor,com.atlassian.jira.plugins.jira-development-integration-plugin:0,-_super,-jira.view.issue,-jira.global,-atl.general,-com.atlassian.jira.projects.sidebar.init,-project.issue.navigator/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":430,"connectEnd":430,"connectStart":430,"domainLookupEnd":430,"domainLookupStart":430,"fetchStart":430,"redirectEnd":0,"redirectStart":0,"requestStart":430,"responseEnd":467.8999996185303,"responseStart":467.8999996185303,"secureConnectionStart":430},{"duration":41.69999980926514,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/4.1.17/_/download/resources/com.atlassian.jira.plugins.jira-editor-plugin:tinymce/tinymce.js?batch=false","startTime":430.3999996185303,"connectEnd":430.3999996185303,"connectStart":430.3999996185303,"domainLookupEnd":430.3999996185303,"domainLookupStart":430.3999996185303,"fetchStart":430.3999996185303,"redirectEnd":0,"redirectStart":0,"requestStart":430.3999996185303,"responseEnd":472.0999994277954,"responseStart":472.0999994277954,"secureConnectionStart":430.3999996185303},{"duration":42.5,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/4.1.17/_/download/resources/com.atlassian.jira.plugins.jira-editor-plugin:tinymce/tinymce-amd.js?batch=false","startTime":430.69999980926514,"connectEnd":430.69999980926514,"connectStart":430.69999980926514,"domainLookupEnd":430.69999980926514,"domainLookupStart":430.69999980926514,"fetchStart":430.69999980926514,"redirectEnd":0,"redirectStart":0,"requestStart":430.69999980926514,"responseEnd":473.19999980926514,"responseStart":473.19999980926514,"secureConnectionStart":430.69999980926514},{"duration":42.70000076293945,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/4.1.17/_/download/resources/com.atlassian.jira.plugins.jira-editor-plugin:tinymce/themes/modern/theme.js?batch=false","startTime":431.0999994277954,"connectEnd":431.0999994277954,"connectStart":431.0999994277954,"domainLookupEnd":431.0999994277954,"domainLookupStart":431.0999994277954,"fetchStart":431.0999994277954,"redirectEnd":0,"redirectStart":0,"requestStart":431.0999994277954,"responseEnd":473.80000019073486,"responseStart":473.80000019073486,"secureConnectionStart":431.0999994277954}],"threshold":1000,"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":4,"responseStart":82,"responseEnd":83,"domLoading":86,"domInteractive":673,"domContentLoadedEventStart":673,"domContentLoadedEventEnd":734,"domComplete":754,"loadEventStart":754,"loadEventEnd":756,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[],"measures":[],"correlationId":"8c40e2caf3c4a6","effectiveType":"4g","downlink":9.1,"rtt":0,"serverDuration":47,"dbReadsTimeInMs":11,"dbConnsTimeInMs":13,"applicationHash":"156decd7d2b4272533aa6cefc8294af635e1da97","experiments":[]}}
Issue is already verified and closed from Praetorian team.