ZAP API Scan Report

[github-actions]

• Site: https://api-ccte-stg.epa.gov
  New Alerts
  • Unexpected Content-Type was returned [100001] total: 4:
    • https://api-ccte-stg.epa.gov/computeMetadata/v1/
    • https://api-ccte-stg.epa.gov/latest/meta-data/
    • https://api-ccte-stg.epa.gov/metadata/instance
    • https://api-ccte-stg.epa.gov/opc/v1/instance/
  • Base64 Disclosure [10094] total: 1:
    • https://api-ccte-stg.epa.gov/docs/chemical.json
  • Non-Storable Content [10049] total: 1:
    • https://api-ccte-stg.epa.gov/docs/chemical.json
  • Sec-Fetch-Dest Header is Missing [90005] total: 1:
    • https://api-ccte-stg.epa.gov/docs/chemical.json
  • Sec-Fetch-Mode Header is Missing [90005] total: 1:
    • https://api-ccte-stg.epa.gov/docs/chemical.json
  • Sec-Fetch-Site Header is Missing [90005] total: 1:
    • https://api-ccte-stg.epa.gov/docs/chemical.json
  • Sec-Fetch-User Header is Missing [90005] total: 1:
    • https://api-ccte-stg.epa.gov/docs/chemical.json

View the following link to download the report.
RunnerID:17857720888

---

ZAP by Checkmarx

[github-actions]

• Site: https://ctx-api-stg.ccte.epa.gov
  New Alerts
  • Application Error Disclosure [90022] total: 3:
    • https://ctx-api-stg.ccte.epa.gov/chemical/file/image/generate?smiles=CC(C)(C1=CC=C(O)C=C1)C1=CC=C(O)C=C1&Image%20Format=PNG
    • https://ctx-api-stg.ccte.epa.gov/chemical/msready/search/by-dtxcid/
    • https://ctx-api-stg.ccte.epa.gov/chemical/msready/search/by-mass/
  • Information Disclosure - Debug Error Messages [10023] total: 3:
    • https://ctx-api-stg.ccte.epa.gov/chemical/file/image/generate?smiles=CC(C)(C1=CC=C(O)C=C1)C1=CC=C(O)C=C1&Image%20Format=PNG
    • https://ctx-api-stg.ccte.epa.gov/chemical/msready/search/by-dtxcid/
    • https://ctx-api-stg.ccte.epa.gov/chemical/msready/search/by-mass/
  • Insufficient Site Isolation Against Spectre Vulnerability [90004] total: 12:
    • https://ctx-api-stg.ccte.epa.gov/docs/chemical.json
    • https://ctx-api-stg.ccte.epa.gov/chemical/ghslink/to-dtxsid/
    • https://ctx-api-stg.ccte.epa.gov/chemical/indigo/to-canonicalsmiles
    • https://ctx-api-stg.ccte.epa.gov/chemical/indigo/to-inchi
    • https://ctx-api-stg.ccte.epa.gov/chemical/indigo/to-inchikey
    • ..
  • Server Leaks Version Information via "Server" HTTP Response Header Field [10036] total: 1:
    • https://ctx-api-stg.ccte.epa.gov/docs/chemical.json
  • Strict-Transport-Security Header Not Set [10035] total: 12:
    • https://ctx-api-stg.ccte.epa.gov/docs/chemical.json
    • https://ctx-api-stg.ccte.epa.gov/chemical/ghslink/to-dtxsid/
    • https://ctx-api-stg.ccte.epa.gov/chemical/indigo/to-canonicalsmiles
    • https://ctx-api-stg.ccte.epa.gov/chemical/indigo/to-inchikey
    • https://ctx-api-stg.ccte.epa.gov/chemical/indigo/to-mol2000
    • ..
  • Unexpected Content-Type was returned [100001] total: 12:
    • https://ctx-api-stg.ccte.epa.gov
    • https://ctx-api-stg.ccte.epa.gov/
    • https://ctx-api-stg.ccte.epa.gov/336319480186598049
    • https://ctx-api-stg.ccte.epa.gov/chemical
    • https://ctx-api-stg.ccte.epa.gov/docs
    • ..
  • X-Content-Type-Options Header Missing [10021] total: 12:
    • https://ctx-api-stg.ccte.epa.gov/chemical/search/start-with/DTXSID7020182?top=500
    • https://ctx-api-stg.ccte.epa.gov/chemical/synonym/search/by-dtxsid/DTXSID7020182
    • https://ctx-api-stg.ccte.epa.gov/chemical/wikipedia/by-dtxsid/DTXSID7020182
    • https://ctx-api-stg.ccte.epa.gov/docs/chemical.json
    • https://ctx-api-stg.ccte.epa.gov/chemical/detail/search/by-dtxcid/?projection=chemicaldetailall
    • ..
  • Base64 Disclosure [10094] total: 12:
    • https://ctx-api-stg.ccte.epa.gov/chemical/file/image/search/by-dtxcid/DTXCID505?Image%20Format=PNG
    • https://ctx-api-stg.ccte.epa.gov/chemical/file/image/search/by-dtxsid/DTXSID7020182?Image%20Format=PNG
    • https://ctx-api-stg.ccte.epa.gov/chemical/list/?projection=chemicallistall
    • https://ctx-api-stg.ccte.epa.gov/chemical/list/search/by-dtxsid/DTXSID1020560?projection=chemicallistall
    • https://ctx-api-stg.ccte.epa.gov/chemical/list/search/by-type/other?projection=chemicallistall
    • ..
  • Non-Storable Content [10049] total: 1:
    • https://ctx-api-stg.ccte.epa.gov/docs/chemical.json
  • Re-examine Cache-control Directives [10015] total: 12:
    • https://ctx-api-stg.ccte.epa.gov/chemical/opsin/to-inchikey/acetamide
    • https://ctx-api-stg.ccte.epa.gov/chemical/property/predicted/search/by-dtxsid/DTXSID7020182
    • https://ctx-api-stg.ccte.epa.gov/chemical/property/summary/search/?dtxsid=dtxsid&propName=propName
    • https://ctx-api-stg.ccte.epa.gov/chemical/property/summary/search/by-dtxsid/DTXSID7020182
    • https://ctx-api-stg.ccte.epa.gov/chemical/search/by-exact-formula/C15H16O2
    • ..
  • Sec-Fetch-Dest Header is Missing [90005] total: 3:
    • https://ctx-api-stg.ccte.epa.gov/chemical/search/equal/
    • https://ctx-api-stg.ccte.epa.gov/chemical/synonym/search/by-dtxsid/
    • https://ctx-api-stg.ccte.epa.gov/chemical/wikipedia/by-dtxsid/
  • Sec-Fetch-Mode Header is Missing [90005] total: 3:
    • https://ctx-api-stg.ccte.epa.gov/chemical/search/equal/
    • https://ctx-api-stg.ccte.epa.gov/chemical/synonym/search/by-dtxsid/
    • https://ctx-api-stg.ccte.epa.gov/chemical/wikipedia/by-dtxsid/
  • Sec-Fetch-Site Header is Missing [90005] total: 3:
    • https://ctx-api-stg.ccte.epa.gov/chemical/search/equal/
    • https://ctx-api-stg.ccte.epa.gov/chemical/synonym/search/by-dtxsid/
    • https://ctx-api-stg.ccte.epa.gov/chemical/wikipedia/by-dtxsid/
  • Sec-Fetch-User Header is Missing [90005] total: 3:
    • https://ctx-api-stg.ccte.epa.gov/chemical/search/equal/
    • https://ctx-api-stg.ccte.epa.gov/chemical/synonym/search/by-dtxsid/
    • https://ctx-api-stg.ccte.epa.gov/chemical/wikipedia/by-dtxsid/
  • Storable but Non-Cacheable Content [10049] total: 11:
    • https://ctx-api-stg.ccte.epa.gov/chemical/indigo/to-canonicalsmiles
    • https://ctx-api-stg.ccte.epa.gov/chemical/indigo/to-inchikey
    • https://ctx-api-stg.ccte.epa.gov/chemical/indigo/to-mol2000
    • https://ctx-api-stg.ccte.epa.gov/chemical/indigo/to-mol3000
    • https://ctx-api-stg.ccte.epa.gov/chemical/indigo/to-molweight
    • ..

View the following link to download the report.
RunnerID:18750664315

[github-actions]

• Site: https://ctx-api-stg.ccte.epa.gov
  New Alerts
  • SQL Injection [40018] total: 8:
    • https://ctx-api-stg.ccte.epa.gov/chemical/count/by-exact-formula/C15H16O2?projection=count+AND+1%3D1+--+
    • https://ctx-api-stg.ccte.epa.gov/chemical/count/by-msready-formula/C15H16O2?projection=count+AND+1%3D1+--+
    • https://ctx-api-stg.ccte.epa.gov/chemical/detail/search/by-dtxcid/?projection=chemicaldetailall%27+AND+%271%27%3D%271%27+--+
    • https://ctx-api-stg.ccte.epa.gov/chemical/detail/search/by-dtxsid/?projection=chemicaldetailall%27+AND+%271%27%3D%271%27+--+
    • https://ctx-api-stg.ccte.epa.gov/chemical/extra-data/search/by-dtxsid/
    • ..

View the following link to download the report.
RunnerID:18757211101

[github-actions]

• Site: https://ctx-api-stg.ccte.epa.gov
  Resolved Alerts
  • SQL Injection [40018] total: 8:

View the following link to download the report.
RunnerID:18914725508

[madison-feshuk]

@jpowel01 @JKenan could update the URLs used within the ZAP API Scan Reports to https://comptox.epa.gov/ctx-api/? @bridirks says it's a devOps issue and outside her control