Security Requirement Object With Wrong Scopes

• Query id: 37140f7f-724a-4c87-a536-e9cee1d61533
• Query name: Security Requirement Object With Wrong Scopes
• Platform: OpenAPI
• Severity: Info
• Category: Structure and Semantics
• CWE: 665
• URL: Github

Description

Security Requirement Object should only have scopes defined for security schemes of type 'oauth2' and 'openIdConnect'
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - json file

{
  "openapi": "3.0.0",
  "info": {
    "title": "Simple API Overview",
    "version": "1.0.0"
  },
  "security": [
    {
      "api_key": [
        "write:api",
        "read:api"
      ]
    },
    {
      "petstore_auth": [
        "write:pets",
        "read:pets"
      ]
    }
  ],
  "paths": {},
  "components": {
    "securitySchemes": {
      "api_key": {
        "type": "apiKey",
        "name": "api_key",
        "in": "header"
      },
      "petstore_auth": {
        "type": "oauth2",
        "flows": {
          "implicit": {
            "authorizationUrl": "http://example.org/api/oauth/dialog",
            "scopes": {
              "write:pets": "modify pets in your account",
              "read:pets": "read your pets"
            }
          }
        }
      }
    }
  }
}

Positive test num. 2 - yaml file

openapi: 3.0.0
info:
  title: Simple API Overview
  version: 1.0.0
security:
  - api_key:
      - write:pets
      - read:pets
  - petstore_auth:
      - write:pets
      - read:pets
paths: {}
components:
  securitySchemes:
    api_key:
      type: apiKey
      name: api_key
      in: header
    petstore_auth:
      type: oauth2
      flows:
        implicit:
          authorizationUrl: http://example.org/api/oauth/dialog
          scopes:
            write:pets: modify pets in your account
            read:pets: read your pets

Positive test num. 3 - json file

{
  "openapi": "3.0.0",
  "info": {
    "title": "Simple API Overview",
    "version": "1.0.0"
  },
  "paths": {
    "/pets": {
      "get": {
        "description": "Returns all pets from the system that the user has access to",
        "responses": {
          "200": {
            "description": "A list of pets.",
            "content": {
              "application/json": {
                "schema": {
                  "type": "array",
                  "items": {
                    "$ref": "#/components/schemas/pet"
                  }
                }
              }
            }
          }
        },
        "security": [
          {
            "api_key": [
              "write:pets",
              "read:pets"
            ]
          },
          {
            "petstore_auth": [
              "write:pets",
              "read:pets"
            ]
          }
        ]
      }
    }
  },
  "components": {
    "securitySchemes": {
      "api_key": {
        "type": "apiKey",
        "name": "api_key",
        "in": "header"
      },
      "petstore_auth": {
        "type": "oauth2",
        "flows": {
          "implicit": {
            "authorizationUrl": "http://example.org/api/oauth/dialog",
            "scopes": {
              "write:pets": "modify pets in your account",
              "read:pets": "read your pets"
            }
          }
        }
      }
    }
  }
}

Positive test num. 4 - yaml file

openapi: 3.0.0
info:
  title: Simple API Overview
  version: 1.0.0
paths:
  "/pets":
    get:
      description: Returns all pets from the system that the user has access to
      responses:
        "200":
          description: A list of pets.
          content:
            application/json:
              schema:
                type: array
                items:
                  "$ref": "#/components/schemas/pet"
      security:
        - api_key:
            - write:pets
            - read:pets
        - petstore_auth:
            - write:pets
            - read:pets
components:
  securitySchemes:
    api_key:
      type: apiKey
      name: api_key
      in: header
    petstore_auth:
      type: oauth2
      flows:
        implicit:
          authorizationUrl: http://example.org/api/oauth/dialog
          scopes:
            write:pets: modify pets in your account
            read:pets: read your pets

Code samples without security vulnerabilities

Negative test num. 1 - json file

{
  "openapi": "3.0.0",
  "info": {
    "title": "Simple API Overview",
    "version": "1.0.0"
  },
  "security": [
    {
      "api_key": []
    },
    {
      "petstore_auth": [
        "write:pets",
        "read:pets"
      ]
    }
  ],
  "paths": {},
  "components": {
    "securitySchemes": {
      "api_key": {
        "type": "apiKey",
        "name": "api_key",
        "in": "header"
      },
      "petstore_auth": {
        "type": "oauth2",
        "flows": {
          "implicit": {
            "authorizationUrl": "http://example.org/api/oauth/dialog",
            "scopes": {
              "write:pets": "modify pets in your account",
              "read:pets": "read your pets"
            }
          }
        }
      }
    }
  }
}

Negative test num. 2 - yaml file

openapi: 3.0.0
info:
  title: Simple API Overview
  version: 1.0.0
security:
  - api_key: []
  - petstore_auth:
      - write:pets
      - read:pets
paths: {}
components:
  securitySchemes:
    api_key:
      type: apiKey
      name: api_key
      in: header
    petstore_auth:
      type: oauth2
      flows:
        implicit:
          authorizationUrl: http://example.org/api/oauth/dialog
          scopes:
            write:pets: modify pets in your account
            read:pets: read your pets

Negative test num. 3 - json file

{
  "openapi": "3.0.0",
  "info": {
    "title": "Simple API Overview",
    "version": "1.0.0"
  },
  "paths": {
    "/pets": {
      "get": {
        "description": "Returns all pets from the system that the user has access to",
        "responses": {
          "200": {
            "description": "A list of pets.",
            "content": {
              "application/json": {
                "schema": {
                  "type": "array",
                  "items": {
                    "$ref": "#/components/schemas/pet"
                  }
                }
              }
            }
          }
        },
        "security": [
          {
            "api_key": []
          },
          {
            "petstore_auth": [
              "write:pets",
              "read:pets"
            ]
          }
        ]
      }
    }
  },
  "components": {
    "securitySchemes": {
      "api_key": {
        "type": "apiKey",
        "name": "api_key",
        "in": "header"
      },
      "petstore_auth": {
        "type": "oauth2",
        "flows": {
          "implicit": {
            "authorizationUrl": "http://example.org/api/oauth/dialog",
            "scopes": {
              "write:pets": "modify pets in your account",
              "read:pets": "read your pets"
            }
          }
        }
      }
    }
  }
}

Negative test num. 4 - yaml file

openapi: 3.0.0
info:
  title: Simple API Overview
  version: 1.0.0
paths:
  "/pets":
    get:
      description: Returns all pets from the system that the user has access to
      responses:
        "200":
          description: A list of pets.
          content:
            application/json:
              schema:
                type: array
                items:
                  "$ref": "#/components/schemas/pet"
      security:
        - api_key: []
        - petstore_auth:
            - write:pets
            - read:pets
components:
  securitySchemes:
    api_key:
      type: apiKey
      name: api_key
      in: header
    petstore_auth:
      type: oauth2
      flows:
        implicit:
          authorizationUrl: http://example.org/api/oauth/dialog
          scopes:
            write:pets: modify pets in your account
            read:pets: read your pets