Inside a scan: what $3.12 finds in OWASP Juice Shop

A RedMirror scan of OWASP Juice Shop's 61 server-side route handlers took about 22 minutes and cost $3.12. Against the benchmark's public list of planted bugs, it surfaced findings in 9 of the roughly 11 code-reachable categories and confirmed eight defects, including the login SQL injection, a zip-slip file write, and a CAPTCHA bypass.

Most of our other write-ups scan ordinary code where nobody knows in advance what is wrong. This one is different on purpose. OWASP Juice Shop is the reference deliberately-insecure web application, and its vulnerabilities are documented: a published list of planted bugs across injection, broken access control, XSS, broken authentication and more. That makes it the one target where you can do something you can't do on a private repo — score the scanner against ground truth. If we claim a SQL injection in the login route, you can open the file and the official challenge list and check.

We pointed redmirror scan at the server-side API — the routes/ directory, 61 request handlers where most of the planted server-side bugs live. Twenty-two minutes and $3.12 later, here is what came back.

What did the scan find at a glance?

A candidate is called Confirmed only when the deciding code path was read and the defect follows from the code as written. Everything else is shown, not hidden: candidates that need context we couldn't see from the file stay in a “needs analysis” list, and candidates a careful reading proves safe are investigated and ruled out with the reason. Severity is never inflated. On a target this dense, the eight confirmed are the high-confidence core; the wider hundred candidates are where the recall lives, each labelled with what it would take to confirm it.

What are the confirmed defects?

The login SQL injection

// routes/login.ts
models.sequelize.query(
  `SELECT * FROM Users WHERE email = '${req.body.email || ''}'
    AND password = '${security.hash(req.body.password || '')}' AND deletedAt IS NULL`,
  { model: UserModel, plain: true })

Zip-slip: arbitrary file write on upload

const absolutePath = path.resolve('uploads/complaints/' + fileName)
if (absolutePath.includes(path.resolve('.'))) {          // includes(), not startsWith()
  await pipeline(entry.stream(),
    fs.createWriteStream('uploads/complaints/' + fileName))
}

The CAPTCHA that always passes

if (!captchas[0] || req.body.answer === captchas[0].answer) {
  next()                          // proceeds when NO captcha exists at all
}

And four more

• Path traversal in a YAML read (routes/vulnCodeFixes.ts): a user-supplied key is concatenated into a file path with no ../ filtering.
• Authorization bypass via a forged continue code (routes/order.ts): a broken-access-control path that accepts a value a client can construct.
• Unauthenticated delivery-status manipulation (routes/delivery.ts): a state change reachable without the ownership check that should gate it.
• Weak JWT verification (routes/verify.ts): a token signature checked without pinning it to a trusted key — the token-forgery class Juice Shop is known for.

How did the scan score against the known bug list?

This is the part you can only do on a benchmark. Of Juice Shop's ~11 vulnerability categories that a source review of the API can reach (the rest — leaked-file hunts, out-of-date dependencies, obscure UI tricks — are not code defects a route review would find), the scan surfaced findings in nine:

Nine of ten reached, five of them as confirmed defects. The one miss is honest: Juice Shop's XXE lives in an upload handler outside the routes/ directory we scoped, so it was never in scope — scan lib/ too and it comes into range. We'd rather tell you that than quietly drop the denominator.

What are the hundred candidates?

Below the eight confirmations sits a longer list: an external value reaching a database query, a file path, a redirect or a response without a visible sanitizer on the way. Many are the other half of the injection and access-control challenges. They aren't promoted to “confirmed” because confirming each one needs a fact the single file doesn't show — whether that input is actually attacker-reachable, or neutralised in a helper defined elsewhere. So they're presented as leads with exactly that question attached, not as a wall of red. It's the difference between “here are eight things that are wrong” and “here are a hundred things to be scared of.”

What do the numbers add up to?

• 61 route handlers, 4,235 lines → 8 confirmed, 100 candidates for review, 3 investigated and ruled out.
• Findings in 9 of the 10 code-reachable vulnerability categories; the one miss lives outside the scanned directory.
• 168,779 tokens across 133 model calls, ~22 minutes, $3.12, billed to the token.

Three dollars, one directory, and the scanner walked onto most of a benchmark that exists specifically to be hard to fully catch. A small package runs a few cents; you always see the estimate before you spend anything. See the measured cost table for more real runs, or the vulnerabilities we've reported in real OSS.

Frequently asked questions