approve-expense.yaml

objectType: Feature
name: approve_expense
description: As a Project Manager, I would like to approve legitimate expenses from my employees
abuse_cases:
  - name: manipulate expense approval
    description: As a malicious user, I will manipulate the expense approval process so I can get bogus expense approved
    threat_scenarios:
    - name: sql injection expense limit bypass
      type: repo
      description: Perform SQL Injection to compromise the Database, and raise project budget limits or bypass expense controls
      reference: {name: sql_injection, severity: 3}

    - name: compromise manager password
      type: repo
      description: Compromise my manager's password and increase budgets to approve expenses
      reference: {name: weak-default-password, severity: 2}

    - name: compromise manager auth token
      type: repo
      description: Attempt to steal manager's authentication token through XSS to elevate privileges to manager's account and approve expenses
      reference: {name: xss, severity: 3}

    - name: authorization bypass
      type: repo
      reference: {name: idor_pk, severity: 3}
      description: Perform Authorization Bypass through IDOR or Mass Assignment style vulnerabilities to get unauthorized expenses approved

internal_interactions:
- approve_expense: "HTTP POST Request"
- logout: "HTTP GET Request"
part_of: core_webservice