SourceCodeDisclosureFileInclusionScanRule should not mix `4xx` responses with `200` responses when performing analysis

Describe the bug:

https://github.com/zaproxy/zap-extensions/blob/2e441bfb3d068fed7fd790f33b23e1b80aae6823/addOns/ascanrulesBeta/src/main/java/org/zaproxy/zap/extension/ascanrulesBeta/SourceCodeDisclosureFileInclusionScanRule.java#L240-L247 does some magic where it sends two requests, a baseline and an attack.

Immediately after doing that, it should compare the HTTP response codes. If they differ, it can't seriously treat the outputs as related/comparable. But, It doesn't compare the HTTP response code between the two.

Instead, it tries to compare the response body: https://github.com/zaproxy/zap-extensions/blob/2e441bfb3d068fed7fd790f33b23e1b80aae6823/addOns/ascanrulesBeta/src/main/java/org/zaproxy/zap/extension/ascanrulesBeta/SourceCodeDisclosureFileInclusionScanRule.java#L249-L252

And then it complains: https://github.com/zaproxy/zap-extensions/blob/2e441bfb3d068fed7fd790f33b23e1b80aae6823/addOns/ascanrulesBeta/src/main/java/org/zaproxy/zap/extension/ascanrulesBeta/SourceCodeDisclosureFileInclusionScanRule.java#L328-L342

Steps to reproduce the behavior:

1. Have a graphql endpoint which can return real responses for valid queries
2. Have the endpoint return a 4xx response for invalid queries
3. Let the SourceCodeDisclosureFileInclusionScanRule run against that endpoint

Expected behavior:

If the response code for the baseline is 200, and the response code for the attack is 4xx, then skip all processing, because it is not indicative of anything exciting. Success pages and Error pages are expected to differ considerably in their shape.

Software Versions:

ZAP Version: 2.16.1

Installed Add-ons: [[id=accessControl, version=10.0.0], [id=alertFilters, version=25.0.0], [id=ascanrules, version=77.0.0], [id=ascanrulesBeta, version=63.0.0], [id=authhelper, version=0.33.0], [id=authstats, version=2.0.0], [id=automation, version=0.57.0], [id=bruteforce, version=19.0.0], [id=callhome, version=0.19.0], [id=client, version=0.19.0], [id=commonlib, version=1.38.0], [id=custompayloads, version=0.15.0], [id=database, version=0.8.0], [id=diff, version=17.0.0], [id=directorylistv1, version=9.0.0], [id=directorylistv2_3, version=4.0.0], [id=domxss, version=22.0.0], [id=encoder, version=1.7.0], [id=exim, version=0.15.0], [id=fileupload, version=1.2.1], [id=formhandler, version=6.7.0], [id=fuzz, version=13.16.0], [id=fuzzdb, version=9.0.0], [id=fuzzdboffensive, version=5.0.0], [id=gettingStarted, version=19.0.0], [id=graaljs, version=0.11.0], [id=graphql, version=0.28.0], [id=help, version=21.0.0], [id=hud, version=0.19.0], [id=importurls, version=9.0.0], [id=invoke, version=16.0.0], [id=jsonview, version=3.0.0], [id=jwt, version=1.0.3], [id=network, version=0.24.0], [id=oast, version=0.23.0], [id=onlineMenu, version=14.0.0], [id=openapi, version=47.0.0], [id=postman, version=0.8.0], [id=pscan, version=0.5.0], [id=pscanrules, version=69.0.0], [id=quickstart, version=52.0.0], [id=replacer, version=20.0.0], [id=reports, version=0.42.0], [id=requester, version=7.8.0], [id=retest, version=0.11.0], [id=retire, version=0.52.0], [id=reveal, version=10.0.0], [id=saml, version=10.0.0], [id=saverawmessage, version=7.0.0], [id=savexmlmessage, version=0.3.0], [id=scanpolicies, version=0.6.0], [id=scripts, version=45.16.0], [id=selenium, version=15.42.0], [id=sequence, version=8.0.0], [id=soap, version=28.0.0], [id=spider, version=0.17.0], [id=spiderAjax, version=23.28.0], [id=sqliplugin, version=16.0.0], [id=sse, version=13.0.0], [id=tips, version=15.0.0], [id=wappalyzer, version=21.50.0], [id=webdrivermacos, version=168.0.0], [id=webdriverwindows, version=169.0.0], [id=websocket, version=34.0.0], [id=zest, version=48.10.0]]

Operating System: Mac OS X Architecture: aarch64 CPU Cores: 10 Max Memory: 16 GB Java Version: Eclipse Adoptium 17.0.14 System's Locale: en_US Display Locale: en_GB Format Locale: en_US Default Charset: UTF-8 ZAP Home Directory: /Users/jsoref/Library/Application Support/ZAP/ ZAP Installation Directory: /Applications/ZAP.app/Contents/Java/./ Look and Feel: FlatLaf Light (com.formdev.flatlaf.FlatLightLaf)

Screenshots:

Source Code Disclosure - File Inclusion

High (Medium)

Description

The Path Traversal attack technique allows an attacker access to files, directories, and commands that potentially reside outside the web document root directory. An attacker may manipulate a URL in such a way that the web site will execute or reveal the contents of arbitrary files anywhere on the web server. Any device that exposes an HTTP-based interface is potentially vulnerable to Path Traversal.

Most web sites restrict user access to a specific portion of the file-system, typically called the "web document root" or "CGI root" directory. These directories contain the files intended for user access and the executable necessary to drive web application functionality. To access files or execute commands anywhere on the file-system, Path Traversal attacks will utilize the ability of special-characters sequences.

The most basic Path Traversal attack uses the "../" special-character sequence to alter the resource location requested in the URL. Although most popular web servers will prevent this technique from escaping the web document root, alternate encodings of the "../" sequence may help bypass the security filters. These method variations include valid and invalid Unicode-encoding ("..%u2216" or "..%c0%af") of the forward slash character, backslash characters ("..") on Windows-based servers, URL encoded characters "%2e%2e%2f"), and double URL encoding ("..%255c") of the backslash character.

Even if the web server properly restricts Path Traversal attempts in the URL path, a web application itself may still be vulnerable due to improper handling of user-supplied input. This is a common problem of web applications that use template mechanisms or load static text from files. In variations of the attack, the original URL parameter value is substituted with the file name of one of the web application's dynamic scripts. Consequently, the results can reveal source code because the file is interpreted as text instead of an executable script. These techniques often employ additional special characters such as the dot (".") to reveal the listing of the current working directory, or "%00" NULL characters in order to bypass rudimentary file extension checks.

• URL: https://.../graph-ql

  • Method: POST
  • Parameter: Operation.Function.Argument
  • Attack: graph-ql
  • Evidence: ``
  • Other Info: [graph-ql] differs sufficiently from that of the random parameter [qnvzlnuzwunmspjzffejglrxmxdfseabgqzrha], at [39%], compared to a threshold of [75%]`

Errors from the zap.log file:

No response

Additional context:

The Parameter field is incredibly misleading. I naively assumed that I could search my logs for it, but, in fact, it was the result of merging three different strings from different parts of the graphql post.

Also note that it'd be really helpful if each attack pair included a shared unique id so that users could check their logs and identify the paired requests instead of seeing dozens of requests that are not actually for a pair.

Would you like to help fix this issue?

• Yes