PTES / NIST SP 800-115 · Proof-Driven API Validation Enginecommit: 9f4c2a1e · openapi: sha256:4b8e91c0
Deterministic API Finding Validation & Hybrid Proof Engine
Do not ask an LLM whether an API vulnerability looks exploitable. Combine OpenAPI 3.1 contract analysis, controller AST predicate inspection, and controlled multi-principal HTTP replay to verify reachability and generate commit-bound 6-Point Proof Contracts.
Ingested API Alerts8OpenAPI + Gateway + SAST
Confirmed w/ Proof66/6 Proof Contracts Complete
False Positives Filtered1API-009 Bound SQL Parameter
Z3 Security Claims53 Counterexamples Isolated
Pluggable API Analyzers10BOLA, BFLA, JWT, CORS, SSRF
Mutation Catch Rate95.0%19/20 Seeded API Mutants
Validation Pipeline Architecture (Stages A → F)
Stage A
OpenAPI & Gateway Ingest
OpenAPI 3.1, GraphQL SDL, SARIF & Kong/Envoy logs
Stage B
Route AST & Auth Context
Controller AST, JWT middleware chain & ORM predicates
Stage C
Validation Planner
Selects Role-Differential, JWT Guard, or DTO probe
Stage D1 + D2
Static + Role Replay
ORM predicate check + Tenant A vs. Tenant B lab replay
Stage E
Independent Verifier
Requires >=98% replay match & 6-Point Proof Contract
Stage F
Remediation & Contract
Emits middleware patch + Pytest/Schemathesis test
Canonical API Findings (8)
API-001 · API1:2023 (CWE-639)CONFIRMED
BOLA — Cross-Tenant User Record Access via Path ID
GET /api/v2/users/{id} · services/users/controllers/user_controller.py:L42–L68
Stage D1 · Static Controller AST & Policy Verdict
Middleware Chain: verify_jwt_bearer -> rate_limit_standard
Reachable Route: Yes (OpenAPI + Router AST verified)
Predicate Analysis: Missing `AND users.tenant_id = :jwt_tenant_id` in SQLAlchemy query
Sink: session.query(User).filter(User.id == path_id).first()
Stage D2 · Controlled Multi-Principal Runtime Differential Replay
Principal A Context
Tenant A (user_1000 · role: member)
Target / Comparison Context
Tenant B Resource (user_1001 · Jane Smith)
Baseline: GET /api/v2/users/1000 -> HTTP 200 OK (own record)
Observed Differential: GET /api/v2/users/1001 with user_1000 JWT -> HTTP 200 OK (leaks ssn_last4, salary)
Determinism: 3 / 3 deterministic replays matched (100%)
Stage E & F · 6-Point Proof ContractSHA: 9f4c2a1e · Spec: sha256:4b8e91c0...d32a
Point 1 · Route-to-Sink Trace
GET /api/v2/users/{id} -> UserController.get_user(id) -> UserRepository.find_by_id(id)
Point 2 · Preconditions & Auth Context
Valid standard member JWT (`sub: 1000`, `tenant_id: org_alpha`) · Target resource `1001` belongs to `tenant_id: org_beta`
Point 3 · Controlled Execution Trace
Replay #1..#3: Principal 1000 requested `/api/v2/users/1001` -> HTTP 200 OK (218 bytes, fields: `id, email, ssn_last4, salary`)
Point 4 · Expected Safe vs. Observed Behavior
Expected: HTTP 403 Forbidden or HTTP 404 Not Found when `resource.tenant_id != jwt.tenant_id` | Observed: HTTP 200 OK returning full cross-tenant User DTO
Point 5 · Replay Reproducibility
100% (3/3 isolated container replays on commit 9f4c2a1e)
Point 6 · Remediation & Executable Contract Test
Add `.filter(User.id == id, User.tenant_id == current_principal.tenant_id)` + Pytest contract `test_get_user_cross_tenant_denied`