CONFIDENTIAL · AIR-GAPPED ASSESSMENT

Adversarial Assurance Report

Adversarial assurance assessment & evidence report

Client / Target	VAmPI (third-party target)
Operation ID	OP-20260913-033940
Report Generated (UTC)	2026-09-13T03:39:46Z
Assessment Mode	Air-gapped · shadow-range · production financial ceiling S$0
Classification	Confidential — restricted to authorized recipients

This document contains confidential security findings intended solely for the named client and its authorized advisors. Distribution, reproduction, or disclosure to any other party without written consent is prohibited. Handle in accordance with the client's information classification policy.

Executive Summary

Confirmed weaknesses

Critical

High

Driven to business impact

Independently replayed

CRITICAL 4HIGH 4MEDIUM 3LOW 1

This engagement confirmed 12 weaknesses across the VAmPI (third-party target) attack surface, of which 4 critical and 4 high-severity findings present immediate risk to the business. X-PHY separates what it observed from what it proved: 6 findings were driven all the way to a business-harmful outcome under independent replay — account takeover, privilege escalation and unauthenticated data exposure — while the remaining 6 are confirmed defect signals (an injection point, an exposed debugger, absent rate-limiting, missing controls) that were observed but not driven to impact. The highest-priority issue, XPHY-API2-006 (JWT signed with a weak, guessable secret), forges an admin session and was independently re-executed three times to eliminate doubt. Every finding here was re-executed by a separate engine; candidates that did not reproduce were discarded rather than reported. Each entry carries a cryptographically sealed evidence capsule that verifies offline.

How to read a proof — three tiers, weakest to strongest

① Weakness observed

A real defect signal was seen (error, exposed control, config) but exploitation was not driven to a business outcome. 6 findings.

② Exploitability proven

The weakness was actively exploited under replay — access gained or state changed — without yet reaching a defined business harm. 0 findings.

③ Business impact proven

Exploitation reached a business-harmful outcome under replay — account takeover, privilege escalation, data exposure. 6 findings.

Methodology. Testing followed NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment) and the OWASP Web Security Testing Guide (WSTG) with mapping to the OWASP API Security Top 10 (2023). Every reported finding is independently reproduced under replay and carries the evidence tier it actually reached — weakness observed, exploitability proven, or business impact proven. Candidates that do not reproduce are discarded rather than reported.

Findings Register

Findings are ordered by attacker priority (descending). Each entry is a self-contained, independently reproducible evidence capsule, labelled with the tier of proof it reached.

XPHY-API2-006

Forgeable session tokens: JWT signed with a weak, guessable secret

CRITICAL CVSS 9.8 Attacker priority 99 API2:2023 Broken Authentication ③ BUSINESS IMPACT PROVEN

Business impactFull Account Takeover

Affected asset/me

Weakness classAPI2:2023 Broken Authentication

Attacker outcomeany identity (incl. admin) forgeable

MITRE ATT&CK

T1552T1078

Proof of Business Impact

Exploit transcript

1POST /users/v1/login -> 200

2GET /me -> 200

Observed evidence

JWT signing secret guessed ('random'); forged token for 'admin' accepted at /me (privileged access)

✓ Independently re-executed 3/3 times — confirmed.

Evidence capsule digest (SHA-256) fd9f8db7c4be0346b7c7ec94b0cf6b9662123cbc9a21b2b9b689f64e9b37e89c

Remediation

Use a long, random, secret-managed signing key; rotate it; reject 'alg:none'.

XPHY-API1-003

BOLA account takeover: any user can reset another user's password

CRITICAL CVSS 9.4 Attacker priority 97 API1:2023 Broken Object Level Authorization ③ BUSINESS IMPACT PROVEN

Business impactAccount Takeover

Affected asset/users/v1/{victim}/password

Weakness classAPI1:2023 Broken Object Level Authorization

Attacker outcomefull account takeover

MITRE ATT&CK

T1190T1078

Proof of Business Impact

Exploit transcript

1POST /users/v1/register -> 200

2POST /users/v1/register -> 200

3POST /users/v1/login -> 200

4PUT /users/v1/bola_b_457c17/password -> 204

5POST /users/v1/login -> 200

Observed evidence

account takeover: user 'bola_a_0c8317' set user 'bola_b_457c17' password; login as 'bola_b_457c17' with new password succeeded

✓ Independently re-executed 3/3 times — confirmed.

Evidence capsule digest (SHA-256) 66d2ba751edaac3d82882c906e9c8cc6fccd9f41ea1a93ba61b11ff5ccddf334

Remediation

Enforce object ownership: the acting principal must own the target object.

XPHY-API1-004

BOLA: any user can change another user's email

CRITICAL CVSS 9.4 Attacker priority 97 API1:2023 Broken Object Level Authorization ③ BUSINESS IMPACT PROVEN

Business impactAccount Integrity Loss

Affected asset/users/v1/{victim}/email

Weakness classAPI1:2023 Broken Object Level Authorization

Attacker outcomevictim email rewritten

MITRE ATT&CK

T1190T1078

Proof of Business Impact

Exploit transcript

1POST /users/v1/register -> 200

2POST /users/v1/register -> 200

3POST /users/v1/login -> 200

4PUT /users/v1/bola_b_cb664f/email -> 204

Observed evidence

user 'bola_a_21c174' modified user 'bola_b_cb664f' via PUT /users/v1/bola_b_cb664f/email (204)

✓ Independently re-executed 3/3 times — confirmed.

Evidence capsule digest (SHA-256) 443debe0cbded1c0efd32b98f637a1ac08bbc82696219c58d94fecac7df4c216

Remediation

Enforce object ownership: the acting principal must own the target object.

XPHY-API8-005

SQL injection at /users/v1/

HIGH CVSS 7.3 Attacker priority 78 API8:2023 Injection ① WEAKNESS OBSERVED · exploitability unproven

Proven impactInjection point — exploitability unproven

Affected asset/users/v1/

Weakness classAPI8:2023 Injection

Attacker outcomeinput reaches the SQL layer unsanitised (data extraction not demonstrated)

MITRE ATT&CK

T1190

Evidence of Weakness

Exploit transcript

1GET /users/v1/name1' -> 500

Observed evidence

A single-quote payload broke the SQL query at /users/v1/ (HTTP 500, SQLAlchemy error). This confirms an unsanitised injection point. Data extraction (UNION / boolean / time-based) was not attempted or demonstrated — so business impact remains unproven and the rating reflects the observed signal, not a worst-case assumption.

✓ Injection point independently re-executed 3/3 times — signal confirmed; exploitability not yet proven.

Evidence capsule digest (SHA-256) 0a598ae98b3810cbe4c992ce5d88259dd23f13d8f8be49498b82abfb4e0ee89b

Remediation

Use parameterised queries / an ORM binding; never string-format user input into SQL.

XPHY-API6-002

Mass assignment allows self-granting 'admin' on registration

CRITICAL CVSS 8.8 Attacker priority 90 API6:2023 Mass Assignment ③ BUSINESS IMPACT PROVEN

Business impactPrivilege Escalation

Affected asset/users/v1/register

Weakness classAPI6:2023 Mass Assignment

Attacker outcomeattacker becomes admin

MITRE ATT&CK

T1078

Proof of Business Impact

Exploit transcript

1POST /users/v1/register -> 200

2GET /users/v1/_debug -> 200

Observed evidence

registered user 'ma_3346d85b' with admin=true accepted by server (privilege escalation)

✓ Independently re-executed 3/3 times — confirmed.

Evidence capsule digest (SHA-256) a710f3c8e70d6d0005e7cb06729daac9d718b218273f54f03374741f2cf46246

Remediation

Whitelist bindable fields; never accept 'admin' from client input.

XPHY-API3-001

Sensitive data exposed without authentication at /users/v1/_debug

HIGH CVSS 7.5 Attacker priority 82 API3:2023 Excessive Data Exposure ③ BUSINESS IMPACT PROVEN

Business impactCustomer Data Exposure

Affected asset/users/v1/_debug

Weakness classAPI3:2023 Excessive Data Exposure

Attacker outcomepassword exposed

MITRE ATT&CK

T1213

Proof of Business Impact

Exploit transcript

1GET /users/v1/_debug -> 200

Observed evidence

unauthenticated GET /users/v1/_debug returned sensitive fields: password

✓ Independently re-executed 3/3 times — confirmed.

Evidence capsule digest (SHA-256) 3029f9db89791380186d9dd94ab93af5460a26318df0c40c50b56bad1b691660

Remediation

Require authentication and strip sensitive fields (password/token) from responses.

XPHY-API8-007

Debug mode enabled: verbose stack traces / interactive debugger exposed

HIGH CVSS 7.2 Attacker priority 68 API8:2023 Security Misconfiguration ① WEAKNESS OBSERVED

Business impactInformation Disclosure

Affected asset/users/v1/name1'

Weakness classAPI8:2023 Security Misconfiguration

Attacker outcomeinternals + potential RCE via debugger

MITRE ATT&CK

T1592

Evidence of Weakness

Exploit transcript

1GET /users/v1/name1' -> 500

Observed evidence

server returned a verbose stack trace / interactive debugger at /users/v1/name1' (Werkzeug Debugger)

✓ Independently re-executed 3/3 times — confirmed.

Evidence capsule digest (SHA-256) a6c1bdd458ad8fb697cab1b9c3b54da9c113f6e440d8a30ac659696bb7a3267b

Remediation

Disable debug mode in production; return generic error pages.

XPHY-API9-009

Undocumented / legacy endpoint reachable: /users/v1/_debug

HIGH CVSS 7.1 Attacker priority 62 API9:2023 Improper Inventory Management ③ BUSINESS IMPACT PROVEN

Business impactSensitive Data Exposure

Affected asset/users/v1/_debug

Weakness classAPI9:2023 Improper Inventory Management

Attacker outcomepassword exposed

MITRE ATT&CK

T1590T1213

Proof of Business Impact

Exploit transcript

1GET /users/v1/_debug -> 200

Observed evidence

undocumented/legacy endpoint /users/v1/_debug reachable without auth and leaks sensitive fields: password

✓ Independently re-executed 3/3 times — confirmed.

Evidence capsule digest (SHA-256) 3c56b88931022fc7f2305566720617c184d12bc606793569c0090eb036924f75

Remediation

Maintain an authoritative API inventory; decommission legacy/debug endpoints or gate them behind auth and network controls.

XPHY-API4-008

No rate limiting on /users/v1/login — brute-force / credential-stuffing enabler

MEDIUM CVSS 5.3 Attacker priority 55 API4:2023 Unrestricted Resource Consumption ① WEAKNESS OBSERVED

Business impactBrute-force & Resource Exhaustion

Affected asset/users/v1/login

Weakness classAPI4:2023 Unrestricted Resource Consumption

Attacker outcome15 rapid attempts, 0 throttled

MITRE ATT&CK

T1110T1499

Evidence of Weakness

Exploit transcript

1POST /users/v1/login -> 200

2POST /users/v1/login -> 200

3POST /users/v1/login -> 200

4POST /users/v1/login -> 200

5POST /users/v1/login -> 200

6POST /users/v1/login -> 200

7POST /users/v1/login -> 200

8POST /users/v1/login -> 200

9POST /users/v1/login -> 200

10POST /users/v1/login -> 200

11POST /users/v1/login -> 200

12POST /users/v1/login -> 200

13POST /users/v1/login -> 200

14POST /users/v1/login -> 200

15POST /users/v1/login -> 200

Observed evidence

fired 15 rapid unauthenticated requests at /users/v1/login; 0 rate-limited (429) or lockout responses (status distribution: 200x15)

✓ Independently re-executed 3/3 times — confirmed.

Evidence capsule digest (SHA-256) deae612a2053b9ed08ba8108a0379a0107d565a09509a5e7812c0b04b05ba379

Remediation

Enforce per-IP/per-account rate limiting and progressive lockout on authentication endpoints.

XPHY-API9-010

Undocumented / legacy endpoint reachable: /console

MEDIUM CVSS 5.3 Attacker priority 48 API9:2023 Improper Inventory Management ① WEAKNESS OBSERVED

Business impactAttack Surface Exposure

Affected asset/console

Weakness classAPI9:2023 Improper Inventory Management

Attacker outcomehidden endpoint reachable

MITRE ATT&CK

T1590T1213

Evidence of Weakness

Exploit transcript

1GET /console -> 200

Observed evidence

undocumented/legacy endpoint /console reachable (200) — path pattern indicates it should not be publicly exposed

✓ Independently re-executed 3/3 times — confirmed.

Evidence capsule digest (SHA-256) ee30d05a247be0cf2e7ba4aee31bd3d809deab568fe57f462b3f5491ad43579a

Remediation

Maintain an authoritative API inventory; decommission legacy/debug endpoints or gate them behind auth and network controls.

XPHY-API8-011

Missing HTTP security headers

MEDIUM CVSS 4.3 Attacker priority 40 API8:2023 Security Misconfiguration ① WEAKNESS OBSERVED

Business impactClickjacking / MITM / MIME-sniffing Exposure

Affected asset/

Weakness classAPI8:2023 Security Misconfiguration

Attacker outcomemissing: HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options

MITRE ATT&CK

T1592

Evidence of Weakness

Exploit transcript

1GET / -> 200

Observed evidence

response from / is missing security headers: HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options

✓ Independently re-executed 3/3 times — confirmed.

Evidence capsule digest (SHA-256) 37d0bc35678e65af284fefa6572ab37a1a11475d9a9db2c826505d98f002e4f9

Remediation

Set Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options and X-Frame-Options on all responses.

XPHY-API8-012

Verbose server/version banner disclosure

LOW CVSS 3.7 Attacker priority 28 API8:2023 Security Misconfiguration ① WEAKNESS OBSERVED

Business impactInformation Disclosure (fingerprinting)

Affected asset/

Weakness classAPI8:2023 Security Misconfiguration

Attacker outcomeserver: Werkzeug/2.2.3 Python/3.11.15

MITRE ATT&CK

T1592.002

Evidence of Weakness

Exploit transcript

1GET / -> 200

Observed evidence

response from / discloses software/version banners: server: Werkzeug/2.2.3 Python/3.11.15

✓ Independently re-executed 3/3 times — confirmed.

Evidence capsule digest (SHA-256) 119f8578815bc34f98675bef657cdc5fdf87c62a903f70ccf30638b2cc13587b

Remediation

Suppress or genericise Server/X-Powered-By and framework version headers.

Regulatory Attestation

A single, independently verified evidence base is mapped to the control clauses of each applicable regime below. One reproducible evidence capsule satisfies the evidentiary requirement across multiple frameworks simultaneously.

Framework	Clause / Control	Weakness ID	Invariant	Finding
OWASP API	API3:2023	XPHY-API3-001	API3:2023 Excessive Data Exposure	Sensitive data exposed without authentication at /users/v1/_debug
	API6:2023	XPHY-API6-002	API6:2023 Mass Assignment	Mass assignment allows self-granting 'admin' on registration
	API1:2023	XPHY-API1-003	API1:2023 Broken Object Level Authorization	BOLA account takeover: any user can reset another user's password
	API1:2023	XPHY-API1-004	API1:2023 Broken Object Level Authorization	BOLA: any user can change another user's email
	API8:2023	XPHY-API8-005	API8:2023 Injection	SQL injection at /users/v1/
	API2:2023	XPHY-API2-006	API2:2023 Broken Authentication	Forgeable session tokens: JWT signed with a weak, guessable secret
	API8:2023	XPHY-API8-007	API8:2023 Security Misconfiguration	Debug mode enabled: verbose stack traces / interactive debugger exposed
	API4:2023	XPHY-API4-008	API4:2023 Unrestricted Resource Consumption	No rate limiting on /users/v1/login — brute-force / credential-stuffing enabler
	API9:2023	XPHY-API9-009	API9:2023 Improper Inventory Management	Undocumented / legacy endpoint reachable: /users/v1/_debug
	API9:2023	XPHY-API9-010	API9:2023 Improper Inventory Management	Undocumented / legacy endpoint reachable: /console
	API8:2023	XPHY-API8-011	API8:2023 Security Misconfiguration	Missing HTTP security headers
	API8:2023	XPHY-API8-012	API8:2023 Security Misconfiguration	Verbose server/version banner disclosure
PDPA	Protection	XPHY-API3-001	API3:2023 Excessive Data Exposure	Sensitive data exposed without authentication at /users/v1/_debug
MAS TRM	8.4	XPHY-API6-002	API6:2023 Mass Assignment	Mass assignment allows self-granting 'admin' on registration
	13.2.4	XPHY-API1-003	API1:2023 Broken Object Level Authorization	BOLA account takeover: any user can reset another user's password
	13.2.4	XPHY-API1-004	API1:2023 Broken Object Level Authorization	BOLA: any user can change another user's email
	9.1	XPHY-API2-006	API2:2023 Broken Authentication	Forgeable session tokens: JWT signed with a weak, guessable secret
	13.2.4	XPHY-API4-008	API4:2023 Unrestricted Resource Consumption	No rate limiting on /users/v1/login — brute-force / credential-stuffing enabler
	13.1.1	XPHY-API9-009	API9:2023 Improper Inventory Management	Undocumented / legacy endpoint reachable: /users/v1/_debug
	13.1.1	XPHY-API9-010	API9:2023 Improper Inventory Management	Undocumented / legacy endpoint reachable: /console
PCI DSS 4.0	6.2.4	XPHY-API1-003	API1:2023 Broken Object Level Authorization	BOLA account takeover: any user can reset another user's password
	6.2.4	XPHY-API1-004	API1:2023 Broken Object Level Authorization	BOLA: any user can change another user's email
	6.2.4	XPHY-API8-005	API8:2023 Injection	SQL injection at /users/v1/
	8.3	XPHY-API2-006	API2:2023 Broken Authentication	Forgeable session tokens: JWT signed with a weak, guessable secret
	6.2.4	XPHY-API8-007	API8:2023 Security Misconfiguration	Debug mode enabled: verbose stack traces / interactive debugger exposed
	6.2.4	XPHY-API8-011	API8:2023 Security Misconfiguration	Missing HTTP security headers
	6.2.4	XPHY-API8-012	API8:2023 Security Misconfiguration	Verbose server/version banner disclosure

Evidence Integrity

Every finding above is bound into a hash-chained evidence ledger, sealed to a hardware/software root of trust. The chain and its signature verify entirely offline, without contacting the tester or any external service.

Merkle root hash	d08073c33ad3adc392f1e67095f0e84f0bddc5ad441d70e62384e9ee98991c87
Trust mode	Software signing (Ed25519) · X-PHY hardware attestation available on-prem
Signing key id	XPHY-SIGN-0001
Signature	007435816bff12c42db43c33cf80bc5d…

✓ The evidence chain and cryptographic signature verify offline: any tampering with a finding, transcript, or digest invalidates the root hash and the signature over it.