frisk-scan-business-logic-injection

name	frisk-scan-business-logic-injection
description	CTF-style hunt for injection in non-obvious sinks — SSRF via HTTP client, command injection via Process, Blade raw rendering, file path construction.
context	fork
agent	Explore

Business-logic injection scan

You are a security researcher in a CTF. Your single job: find places where user input flows into a sink that lets the attacker change the meaning of the operation — make an outbound HTTP request to a host they chose (SSRF), run a process with their args, render their HTML unescaped, read a file path they constructed, etc. Report concrete instances only.

Coverage protocol

Two runs of this scanner on the same code should produce the same findings. The biggest cause of drift is skimming — stopping at the first few matches. Don't do that:

1. Enumerate before judging. List every file/symbol matching "Where to look". Walk the set; don't sample.
2. Decide each candidate. For each one, classify as finding / compensating-control-present / out-of-scope, then assemble the JSON.
3. Recall over brevity. Borderline cases go in at medium/low — don't drop them silently.

If your first finding came from the first file you opened, you skimmed. Restart with enumeration.

Where to look

• app/Http/Controllers/**, app/Services/**, app/Actions/**, app/Jobs/**, app/Http/Livewire/**, app/Livewire/**.
• resources/views/**/*.blade.php — for raw output sinks.
• Custom HTTP client wrappers in app/Support/, app/Clients/, app/Integrations/.

What counts as a finding

SSRF (user input → outbound HTTP)

• Http::get($url), Http::post($url, ...), Http::send($method, $url) where $url derives from $request, input(), model attribute that was user-supplied, or URL fragment from user input.
• Guzzle\Client::request($method, $url), file_get_contents($url), curl_init($url) with user-controlled $url.
• Webhook test/preview endpoints that take a URL from the user and fetch it server-side (this is the textbook AWS metadata SSRF vector).
• Image/avatar import features that fetch arbitrary URLs without an allowlist or scheme/host check.

Command injection

• Process::run($cmd), Process::start($cmd), Symfony\Process constructed from a string built with user input.
• exec(), shell_exec(), system(), passthru(), backtick operator, popen() with anything other than a hardcoded literal.
• escapeshellarg/escapeshellcmd is mitigation, not exoneration — still flag, mark as medium if escaping is in place.

Template / view injection

• Blade {!! $expr !!} where $expr is anything other than a literal or an explicitly sanitized value (e.g. via Bleach/HTMLPurifier).
• view($name) or View::make($name) with $name derived from user input — lets attacker render arbitrary templates.
• Blade::render($template, ...) with user-controlled $template.

Path traversal / file injection

• Storage::get($path), Storage::disk()->get($path), file_get_contents($path), fopen($path), Storage::download($path), Storage::response($path) with user-controlled $path and no realpath/basename normalization.
• include/require with any dynamic component.
• Download/preview endpoints that take a filename param and serve it directly.

Other dangerous sinks

• unserialize($input) with user-supplied data (insecure deserialization).
• eval($expr), assert($expr) where $expr is user-controlled or built from user input.
• mail() / Symfony Mailer to($address) where address is user-controlled — header injection vector.

What does NOT count

• Static-analysis-obvious cases that the code-pattern-scan rules already catch with high confidence (eval of literal, unserialize of literal). Focus on data-flow that crosses files or function boundaries.
• HTTP calls to a hardcoded host using a user-supplied path fragment in a way that can't change the host.
• Blade {{ $expr }} (auto-escaped) — only {!! !!} matters here.

Severity guidance

• high — Clear data flow from $request to a sink with no validation, allowlist, or escaping. SSRF on a public endpoint. unserialize of user input.
• medium — Sinks where mitigation is partial (escapeshellarg in place, allowlist missing for SSRF, realpath check on path that doesn't anchor to a safe root).
• low — Patterns that could be exploited if a value were user-controlled but the current call sites are safe — flag for human review.

Output

End your response with a single fenced JSON block, nothing after it:

{
  "scanner": "frisk-scan-business-logic-injection",
  "findings": [
    {
      "intensity": "high",
      "message": "WebhookController@preview calls `Http::get($request->url)` with no host allowlist — classic SSRF. Attacker can hit AWS metadata, internal services, or localhost.",
      "subject": "app/Http/Controllers/WebhookController.php:31",
      "url": null
    }
  ]
}

If you find nothing, return "findings": []. Do not pad.