While running scans with ZAP, I noticed that many of the reported vulnerabilities involve sending malicious content as a value to a parameter named "query". For example:


The api method in question, however, does not have a parameter that goes by this name, so I was wondering how the tool could possibly detect a vulnerability with this. ZAP did, in fact, report an SQL Injection vulnerability with "Medium" confidence from using a url like the above, and has had similar results with path traversal and xss.

Could this be a consequence of me not setting up ZAP correctly? Is it possible to for an api to be made to read parameters that the developers did not define? Is ZAP just guessing at the parameters the api uses?

  • How literal is your example? Did it also report a path/ path parameter? – schroeder May 28 '19 at 18:09
  • URIs are just strings. Any parameter name can be supplied. I'm guessing there is/are frameworks (probably PHP) that have some vulnerability where the internal value of a DB query can be modified by a parameter. – JimmyJames May 28 '19 at 18:10
  • Is there anything in the logs that says what suite of tests is running this? There are 10 or so listed here: owasp.org/index.php/… – JimmyJames May 28 '19 at 18:16
  • The "path" is not literal". The literal parts are before "<url>" and after "?" – harrys May 28 '19 at 18:37
  • Looking for the logs (nothing immediately available in the zap directory). The link provided, however, seems to refer to 10 separate tools, however, rather than 10 different suites that can be used with this tool. – harrys May 28 '19 at 18:47

Yes, its added by this code: https://github.com/zaproxy/zaproxy/blob/develop/zap/src/main/java/org/parosproxy/paros/core/scanner/VariantAbstractQuery.java#L148-L153

This is added to see how webapps react to queries - if they handle them badly then yes this can introduce vulnerabilities.

If you think ZAP has reported false positives then please report them too us: https://github.com/zaproxy/zaproxy/issues/new?labels=bug&template=Bug_report.md

Note: As of ZAP 2.8 the addition of parameters to requests that didn't originally have them is now optional (and default off). Ref: https://github.com/zaproxy/zap-core-help/wiki/HelpUiDialogsOptionsAscaninput#add-url-query-parameter

  • OK. Thank you. It looks like my post is duplicated by another (I should've checked more carefully): security.stackexchange.com/questions/191758/…. So, I'll look at that. It looks like it might be a false positive, so I'll mention it on the board just in case. – harrys May 29 '19 at 14:43
  • The following request was reported as an SQL Injection vulnerability: GET http://<host>:<port>/<path>?query=query+AND+1%3D1+--+ HTTP/1.1 I inserted it into my browser and then inserted this: GET http://<host>:<port>/<path> HTTP/1.1 I found that the content for both requests were identical. This appears to contradict what was reported by ZAP: “The vulnerability was detected by successfully retrieving more data than originally returned, by manipulating the parameter”. – harrys May 29 '19 at 14:45
  • It looks like a similar issue has been reported already and a new version released since then: github.com/zaproxy/zaproxy/issues/4231. I'll check my version, update if necessary and rescan. – harrys May 29 '19 at 15:09
  • The addition of parameters was made optional last fall, it will be available in 2.8. mobile.twitter.com/kingthorin_rm/status/1041855009263108097 – kingthorin May 31 '19 at 9:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.