Analisis Kerentanan dan Hardening Keamanan pada Endpoint API Transaksi DWANPOS Menggunakan OWASP API Security Top 10:2023

Abstract

The increasing adoption of Software as a Service (SaaS) applications introduces security challenges in cross-tenant data isolation and access control. This study analyzes and hardens transaction API endpoints in DWANPOS, a multi-tenant Point of Sale (POS) SaaS platform, together with the shared JWT authentication middleware that protects them. The research employs white-box security testing based on NIST SP 800-115 and the OWASP Web Security Testing Guide (WSTG v4.2). Vulnerabilities are classified using Common Weakness Enumeration (CWE) and mapped to OWASP API Security Top 10:2023 and OWASP Top 10:2021. Static analysis using Gosec and Semgrep with a custom rule is combined with manual code review, while dynamic testing is performed manually using Postman, following a test matrix of six test cases and two authenticated tenant accounts. The assessment identifies a Critical authentication bypass (CVSS v3.1 9.8, CWE-287/CWE-347) caused by hardcoded demo-token logic and two High-severity Broken Object Level Authorization (BOLA) vulnerabilities (CVSS v3.1 7.6 and 7.5, CWE-639 and CWE-862) affecting transaction status modification and history retrieval. Gosec did not detect either class of flaw; they were identified through a custom Semgrep rule (BOLA) and manual code review. Mitigation controls include removing the demo-token bypass, enforcing HMAC-SHA256 signature verification, and binding authenticated user identifiers to GORM queries. Retesting with the same scenarios, together with positive-control tests, shows that cross-tenant access is rejected while legitimate owners retain access to their own data. The findings highlight the importance of combining static analysis with manual business-logic review and positive-control testing to strengthen API authorization.