Skip to main content

Illustrative security report

Northstar Cloud (synthetic multi-tenant SaaS scenario)

Illustrative sample - not a client engagement.

Northstar Cloud, its hosts, people, accounts, requests, responses, and findings are invented. Nothing on this page represents a real customer, production system, or assessment result.

01 / Executive summary

Material risk in two critical workflows

The synthetic assessment identified two high-severity weaknesses. A tenant-boundary flaw allowed an authenticated user to request another tenant's generated report when a valid object identifier was known. A separate unauthenticated retry endpoint could create enough background jobs to exhaust the export-worker queue. Together, these issues could expose customer report data and interrupt a business-critical workflow. The recommended sequence is to centralize tenant-aware authorization, require authenticated and idempotent job creation, add bounded rate controls, then verify both fixes with regression tests and a focused retest.

High findings
2
Coverage areas
5
Constrained area
1
Real client systems
0

02 / Scope and constraints

Scope and constraints

Included

  • app.northstar.example - customer web application
  • api.northstar.example/v1 - documented customer API
  • Authentication, authorization, tenant isolation, report export, and background-job workflows

Excluded

  • Denial-of-service or sustained load testing
  • Social engineering, physical testing, mobile clients, and infrastructure outside the two synthetic hosts
  • Third-party identity-provider internals

Constraints

  • Testing used synthetic accounts and synthetic data only
  • No persistence, destructive actions, or production-data extraction
  • This is a point-in-time sample and does not claim exhaustive coverage

03 / Coverage

What was tested, constrained, or untouched

Assessment coverage by area, status, and note
AreaStatusNote
Identity and sessionTestedLogin, logout, recovery, session rotation, and role changes
Authorization and tenancyTestedObject, function, role, and cross-tenant boundaries
Critical workflowsTestedReport export, sharing, invitation, and background jobs
AvailabilityConstrainedLogic reviewed; no sustained load generated
Third-party IdPNot testedOnly Northstar's integration boundary was assessed

04 / Findings

Findings

HighCJV-SAMPLE-001

Cross-tenant report export through missing object authorization

CVSS 4.0
7.1 / High
Affected
GET /v1/reports/{report_id}/download
Retest status
Resolved in synthetic retest

Observation

The download handler verified that a requester was signed in but did not verify that the requested report belonged to the requester's tenant. A low-privileged member of Tenant Blue could therefore download a generated report owned by Tenant Amber when supplied with Amber's report identifier.

Business context

A successful attack could disclose confidential customer report content across tenant boundaries. In a real SaaS environment, this could create contractual, privacy, and trust consequences beyond the numeric severity score.

CVSS-B vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Evidence trail

  • Synthetic member [email protected] authenticated to Tenant Blue.
  • The member requested /v1/reports/rpt_amber_7Q4/download using Tenant Amber's synthetic report identifier.
  • The API returned HTTP 200 and a synthetic PDF containing marker NORTHSTAR-AMBER-SAMPLE.
  • No other report data was requested or retained.

Synthetic request

GET /v1/reports/rpt_amber_7Q4/download HTTP/1.1
Host: api.northstar.example
Authorization: Bearer <TENANT_BLUE_TEST_TOKEN>

Synthetic response

HTTP/1.1 200 OK
Content-Type: application/pdf
X-Synthetic-Marker: NORTHSTAR-AMBER-SAMPLE

Remediation

  1. 1Resolve the report through a tenant-scoped query derived from the authenticated principal; do not authorize from a client-supplied tenant identifier.
  2. 2Return a uniform not-found response when the object is outside the principal's authorized tenant and role boundary.
  3. 3Centralize this policy and apply it to download, preview, share, delete, and export-status handlers.
  4. 4Add negative integration tests covering cross-tenant access for every supported role.

Retest note

Synthetic retest passed. The revised handler derived tenant_id from the authenticated principal, the original request returned HTTP 404, and same-tenant downloads continued to work. This result applies only to the submitted fix and tested endpoints.

HighCJV-SAMPLE-002

Unauthenticated export retry can exhaust the worker queue

CVSS 4.0
8.7 / High
Affected
POST /v1/exports/{job_id}/retry
Retest status
Mitigation proposed; not retested

Observation

The retry route accepted synthetic job identifiers before authentication and created a new queue item for every request. It did not enforce idempotency, ownership, a retry budget, or a bounded request rate.

Business context

An unauthenticated actor could consume export-worker capacity and delay report generation for legitimate customers. The test did not generate sustained load; impact was validated by code-path review and five bounded requests in the synthetic environment.

CVSS-B vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Evidence trail

  • Five bounded unauthenticated requests produced five distinct synthetic queue identifiers for one job.
  • The handler created the queue item before resolving an authenticated principal.
  • No sustained load or production-like capacity test was performed.

Synthetic request

POST /v1/exports/job_sample_42/retry HTTP/1.1
Host: api.northstar.example
Content-Length: 0

Synthetic response

HTTP/1.1 202 Accepted
Content-Type: application/json

{"queue_id":"synthetic_q_005","status":"queued"}

Remediation

  1. 1Authenticate before resolving or mutating an export job, then authorize ownership and role.
  2. 2Make retry idempotent for an active job and enforce a small server-side retry budget.
  3. 3Apply layered user, tenant, and network rate controls with observable rejection metrics.
  4. 4Alert on abnormal retry volume and queue-depth growth without relying on rate limiting as the authorization control.

Retest note

Not retested in this illustrative version. A real report would record the submitted build, exact retest cases, observed result, and any remaining limitation.

05 / Limitations

Limitations

  • An assessment samples a defined system during an agreed period; it cannot prove the absence of vulnerabilities.
  • Coverage depends on the accuracy of supplied scope, accounts, architecture information, and environmental access.
  • CVSS 4.0 communicates technical severity. Remediation priority also considers exploitability, asset importance, exposure, contractual impact, and compensating controls.
  • OWASP WSTG informed relevant web testing, but test cases were selected and adapted to the synthetic attack surface rather than represented as exhaustive.
  • This report may support an audit evidence package; it is not compliance certification or an auditor's opinion.

06 / References

References

These references guide relevant techniques and communication. They do not turn the assessment into exhaustive coverage or compliance certification.