42 lines
1.9 KiB
JSON
42 lines
1.9 KiB
JSON
|
{
|
||
|
|
"schema_version": "whitehat-probe-pack/v1",
|
||
|
|
"target": "audit-core",
|
||
|
|
"posture_claim": "E2",
|
||
|
|
"attacker_model": "docs/attacker-model.md#3-e2--authenticated-tenant-a-at-the-service-boundary",
|
||
|
|
"notes": [
|
||
|
|
"Use two read-enabled scoped sender identities, each restricted to its fixture tenant.",
|
||
|
|
"A correlation id deliberately spans services; the expected result is the caller's readable tenant slice.",
|
||
|
|
"Instance-wide stats, integrity, dead-letter and secret-finding routes are excluded because their contract is operator-only, not tenant-scoped."
|
||
|
|
],
|
||
|
|
"probes": [
|
||
|
|
{
|
||
|
|
"id": "audit-event-by-id",
|
||
|
|
"operation": "read",
|
||
|
|
"route": "GET /v1/events/{tenant_b_event_id}",
|
||
|
|
"owner": "tenant B sender reads tenant B fixture event",
|
||
|
|
"attacker": "tenant A sender substitutes tenant B fixture event id",
|
||
|
|
"absent": "tenant A sender reads a reserved absent event id",
|
||
|
|
"finding": "tenant B fixture marker is returned or existence differs from absent"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "audit-correlation-slice",
|
||
|
|
"operation": "read",
|
||
|
|
"route": "GET /v1/events?correlation_id={shared_correlation_id}",
|
||
|
|
"owner": "tenant B sender queries correlation shared by A and B fixture events",
|
||
|
|
"attacker": "tenant A sender queries the same correlation",
|
||
|
|
"absent": "tenant A sender queries a reserved correlation with no events",
|
||
|
|
"finding": "tenant B fixture marker appears in tenant A's readable slice"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"id": "audit-append-as-b",
|
||
|
|
"operation": "create",
|
||
|
|
"route": "POST /v1/events",
|
||
|
|
"owner": "tenant B sender appends a tenant B control event",
|
||
|
|
"attacker": "tenant A sender submits a new event claiming tenant B",
|
||
|
|
"absent": "tenant A sender submits an otherwise equivalent disallowed-tenant control",
|
||
|
|
"finding": "append succeeds or subsequent tenant B state contains the attacker event"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
|