Skip to content
Attack Surface Validation LabProject Nightwatch · Synthetic

Phase 04 · Validation

Findings Register

Each entry is a validated finding: confirmed to exist with the minimum non-destructive interaction necessary, rated on business impact rather than scanner score, and recorded with an honest confidence level. Evidence is described in narrative form — this register contains no payloads, bypass strings, or reproduction commands.

Critical
1
High
3
Medium
5
Low
3

Filter by severity

Twelve synthetic findings across eight lab assets.

EH-001

Broken access control in synthetic admin workflow

CriticalRemediatedRetest: Pass
ADMIN-01WEB-01Confidence: Confirmed

Synthetic evidence summary

A lower-privileged lab account was able to reach a tenant-administration workflow whose authorization was enforced primarily in the interface layer. Validation was limited to confirming the server accepted the request context; no tenant data was altered.

Business impact

Allows a standard lab user to perform administrative actions across tenant boundaries, undermining the primary trust boundary of the platform.

Recommended remediation

Enforce authorization server-side on every administrative operation, deny by default, and add automated tests asserting role checks per endpoint.

CWE
CWE-284
OWASP Top 10
A01:2021 Broken Access Control
MITRE ATT&CK
T1078 Valid Accounts (conceptual)
NIST CSF 2.0
PR.AA — Identity Management, Authentication and Access Control

EH-002

Overly broad permissions assigned to synthetic test role

HighRemediatedRetest: Pass
IAM-01Confidence: Confirmed

Synthetic evidence summary

Role definitions exported from the lab identity service show a test role inheriting administrative entitlements that its documented purpose does not require.

Business impact

Any account holding the test role gains far more capability than intended, widening the blast radius of a single account compromise.

Recommended remediation

Rebuild the role from least-privilege requirements, separate test roles from production role hierarchies, and review entitlements quarterly.

CWE
CWE-269
OWASP Top 10
A01:2021 Broken Access Control
MITRE ATT&CK
T1098 Account Manipulation (conceptual)
NIST CSF 2.0
PR.AA — Access permissions managed with least privilege

EH-003

Overly permissive network path between synthetic application and data tiers

HighIn RemediationRetest: Not Retested
APP-02DB-01Confidence: Confirmed

Synthetic evidence summary

Lab network policy review shows the application subnet can reach the data tier on a broader port range than the documented design requires.

Business impact

Reduces containment: a foothold in any application workload reaches the data tier directly rather than through a controlled service interface.

Recommended remediation

Tighten segmentation to the required service port, move to identity-based service authorization, and alert on unexpected tier-to-tier connections.

CWE
CWE-923
OWASP Top 10
A05:2021 Security Misconfiguration
MITRE ATT&CK
T1210 Exploitation of Remote Services (conceptual)
NIST CSF 2.0
PR.IR — Network segmentation and resilience

EH-004

Insecure test upload validation on lab endpoint

HighRemediatedRetest: Pass
WEB-01Confidence: Confirmed

Synthetic evidence summary

The lab upload workflow relied on client-supplied content type rather than server-side validation. A benign synthetic file was accepted under a mismatched declared type; no content was executed or retrieved.

Business impact

Weak content validation increases the likelihood of unsafe file handling downstream and of storage being used as an untrusted content channel.

Recommended remediation

Validate content server-side, restrict accepted types by allow-list, store uploads outside the application root, and serve with non-executable content headers.

CWE
CWE-434
OWASP Top 10
A04:2021 Insecure Design
MITRE ATT&CK
Not conceptually relevant
NIST CSF 2.0
PR.PS — Platform security and secure development practices

EH-005

Missing rate-limit control on lab authentication endpoint

MediumRemediatedRetest: Pass
API-01Confidence: Confirmed

Synthetic evidence summary

Repeated well-formed requests to a lab endpoint were accepted without throttling or lockout signalling. Validation stopped at a small, non-disruptive request volume.

Business impact

Absent throttling, credential-guessing and enumeration attempts against lab accounts are cheap and largely invisible to defenders.

Recommended remediation

Apply per-identity and per-source rate limits, progressive delays, and alerting on abnormal authentication failure rates.

CWE
CWE-307
OWASP Top 10
A07:2021 Identification and Authentication Failures
MITRE ATT&CK
T1110 Brute Force (conceptual)
NIST CSF 2.0
DE.CM — Continuous monitoring of authentication activity

EH-006

Weak session timeout policy on synthetic portal

MediumRemediatedRetest: Pass
WEB-01VPN-01Confidence: Confirmed

Synthetic evidence summary

Session lifetime in the lab configuration substantially exceeds the documented standard, and idle sessions were observed remaining valid well past the expected window.

Business impact

Long-lived sessions extend the useful window of a stolen session and weaken assurance that an active session reflects a present, authorized user.

Recommended remediation

Reduce idle and absolute session lifetimes to policy, re-authenticate before sensitive actions, and invalidate sessions on role change.

CWE
CWE-613
OWASP Top 10
A07:2021 Identification and Authentication Failures
MITRE ATT&CK
Not conceptually relevant
NIST CSF 2.0
PR.AA — Authentication lifecycle management

EH-007

Insecure default security headers on lab web tier

MediumRemediatedRetest: Pass
WEB-01Confidence: Confirmed

Synthetic evidence summary

Response headers on the lab portal omit content security policy, frame protections, and strict transport enforcement expected by the internal baseline.

Business impact

Removes defence-in-depth that limits the impact of client-side flaws and downgrade attempts against the portal.

Recommended remediation

Deploy a baseline header set at the edge, start CSP in report-only mode, and monitor for regressions in the deployment pipeline.

CWE
CWE-693
OWASP Top 10
A05:2021 Security Misconfiguration
MITRE ATT&CK
Not conceptually relevant
NIST CSF 2.0
PR.PS — Secure configuration baselines

EH-008

Secrets represented in a synthetic configuration example

MediumRemediatedRetest: Pass
APP-02Confidence: Confirmed

Synthetic evidence summary

A lab configuration sample contains placeholder credential material committed alongside application code, indicating a workflow where real secrets could follow the same path.

Business impact

Normalises storing credentials in source control, which historically leads to long-lived, widely readable secrets.

Recommended remediation

Move all secret material to a managed secret store, add pre-commit and pipeline secret scanning, and rotate anything previously committed.

CWE
CWE-798
OWASP Top 10
A05:2021 Security Misconfiguration
MITRE ATT&CK
T1552 Unsecured Credentials (conceptual)
NIST CSF 2.0
PR.DS — Data-in-use and credential protection

EH-009

Stale synthetic service account remains enabled

MediumIn RemediationRetest: Not Retested
SVC-03IAM-01Confidence: High

Synthetic evidence summary

Identity review shows a lab service account tied to a retired integration that is still enabled, with credentials older than the documented rotation interval.

Business impact

Unowned, unmonitored credentials are a durable access route that no team is actively watching.

Recommended remediation

Disable the account, assign an owner to every remaining non-human identity, and enforce automated expiry and rotation.

CWE
CWE-1108
OWASP Top 10
A01:2021 Broken Access Control
MITRE ATT&CK
T1078.004 Valid Accounts: Cloud Accounts (conceptual)
NIST CSF 2.0
ID.AM — Inventory of non-human identities

EH-010

Exposed version and banner information on lab gateway

LowClosedRetest: Pass
VPN-01API-01Confidence: Confirmed

Synthetic evidence summary

Service responses disclose product and build identifiers that are not required by any client of the lab service.

Business impact

Lowers attacker research cost by confirming technology and patch level without any interaction with defenders' controls.

Recommended remediation

Suppress version banners, standardise generic error responses, and treat banner suppression as a build-time default.

CWE
CWE-200
OWASP Top 10
A05:2021 Security Misconfiguration
MITRE ATT&CK
T1592 Gather Victim Host Information (conceptual)
NIST CSF 2.0
PR.PS — Configuration hardening

EH-011

Verbose error messages reveal internal structure on lab API

LowRemediatedRetest: Pass
API-01Confidence: Confirmed

Synthetic evidence summary

Malformed but benign requests returned stack context and internal identifiers rather than a generic error contract.

Business impact

Discloses internal structure that supports more targeted follow-on attempts and complicates log-noise triage.

Recommended remediation

Return a stable, generic error contract to clients and keep diagnostic detail in server-side logs correlated by request ID.

CWE
CWE-209
OWASP Top 10
A05:2021 Security Misconfiguration
MITRE ATT&CK
Not conceptually relevant
NIST CSF 2.0
PR.PS — Secure defaults for error handling

EH-012

Insufficient logging of privileged actions in lab admin console

LowOpenRetest: Not Retested
ADMIN-01Confidence: Moderate

Synthetic evidence summary

Administrative operations in the lab console record the outcome but not the acting identity, source, or prior value, limiting reconstruction after the fact.

Business impact

Weak audit trails delay detection and make it difficult to prove what a privileged actor did during an incident.

Recommended remediation

Emit structured audit events with actor, source, target, and before/after state; forward to central logging with alerting on privilege use.

CWE
CWE-778
OWASP Top 10
A09:2021 Security Logging and Monitoring Failures
MITRE ATT&CK
Not conceptually relevant
NIST CSF 2.0
DE.AE — Adverse event analysis

How severity was assigned

Rating basis

Severity reflects realistic exploitability in the lab environment combined with business consequence if the weakness were abused. A weakness that is trivially reachable but low-consequence is rated below one that requires an authenticated foothold yet crosses a tenant boundary. Where validation could not be completed non-destructively, confidence is recorded as Moderate rather than inflating severity.