feat: add orders controller

[maekuss]

Adds a .NET MVC orders controller (OrdersController.cs).

Scanner test PR — intentionally vulnerable. Expected High/Critical findings:

• Insecure Deserialization in Restore — BinaryFormatter.Deserialize on request bytes → gadget-chain RCE (Critical)
• Weak Cryptography in Encrypt — DES (56-bit) in ECB mode with a hardcoded key (High)
• Hardcoded machineKey / ViewState forgery — validation & decryption keys in source → forged __VIEWSTATE → RCE (High)

[hacktron-app-stg]

2 issues found across 1 file

Severity	Count
	1
	1

View full scan results

[hacktron-app-stg]

Use of Broken Cryptographic Algorithm (DES-ECB) with Hardcoded Key

The Encrypt method implements the Data Encryption Standard (DES) in Electronic Codebook (ECB) mode. DES uses a 56-bit key, which is trivially brute-forceable today. ECB mode is deterministic and leaks patterns in the plaintext, failing to provide semantic security. Furthermore, the encryption key is hardcoded as '8bytekey'.

Steps to Reproduce

1. Access the application's exposed endpoint at /Orders/Encrypt?data=test.
2. Observe the returned base64-encoded ciphertext.
3. Because the algorithm is DES in ECB mode with a hardcoded key ("8bytekey"), any attacker can decrypt this ciphertext or encrypt arbitrary payloads using the same key and algorithm.

Fix with AI

A security vulnerability was found by Hacktron.

File: OrdersController.cs
Lines: 34-37
Severity: medium

Vulnerability: Use of Broken Cryptographic Algorithm (DES-ECB) with Hardcoded Key

Description:
The Encrypt method implements the Data Encryption Standard (DES) in Electronic Codebook (ECB) mode. DES uses a 56-bit key, which is trivially brute-forceable today. ECB mode is deterministic and leaks patterns in the plaintext, failing to provide semantic security. Furthermore, the encryption key is hardcoded as '8bytekey'.

Proof of Concept:
**Steps to Reproduce**

1. Access the application's exposed endpoint at `/Orders/Encrypt?data=test`.
2. Observe the returned base64-encoded ciphertext.
3. Because the algorithm is DES in ECB mode with a hardcoded key ("8bytekey"), any attacker can decrypt this ciphertext or encrypt arbitrary payloads using the same key and algorithm.

Acceptance criteria:
- Acceptance is defined by the **actual reported behavior**, not by tests passing.
- Reproduce the issue, or narrow the exact code path that produces it, *before* changing code. State what you confirmed.
- Fix the underlying cause. Mitigations that paper over the reported behavior do not count as a fix.
- Add a regression test that fails on the unpatched code and passes on the fix. If a regression test is genuinely impractical (e.g. race condition, infra-level issue), say so and explain why.
- Existing tests passing is **not** the bar. Do not declare done on tests-pass theatre.

Only change what is necessary to fix this vulnerability. Do not refactor adjacent code or modify unrelated files.

---

_{Triage: Reply !fp <reason> (false positive), !valid (confirmed), !accepted_risk <reason>, or !fixed (resolved). Any other reply is saved as a triage note.
Reason is optional but improves future scans — e.g. !fp internal endpoint, not user-facing.}

_{View finding in Hacktron}

[hacktron-app-stg]

Insecure Deserialization via BinaryFormatter

The Restore action in OrdersController uses BinaryFormatter to deserialize untrusted data directly from the HTTP request stream. BinaryFormatter is inherently unsafe and cannot be secured against malicious serialized objects, allowing an attacker to achieve Remote Code Execution (RCE) on the server via gadget chains.

Steps to Reproduce

1. Generate a .NET gadget chain payload using a tool like ysoserial.net (e.g., targeting TypeConfuseDelegate or another available gadget chain).
2. Send an HTTP POST request to the /Orders/Restore endpoint with the raw binary payload in the request body.
3. The server will deserialize the payload, executing the embedded commands.

Fix with AI

A security vulnerability was found by Hacktron.

File: OrdersController.cs
Lines: 25-26
Severity: critical

Vulnerability: Insecure Deserialization via BinaryFormatter

Description:
The `Restore` action in `OrdersController` uses `BinaryFormatter` to deserialize untrusted data directly from the HTTP request stream. `BinaryFormatter` is inherently unsafe and cannot be secured against malicious serialized objects, allowing an attacker to achieve Remote Code Execution (RCE) on the server via gadget chains.

Proof of Concept:
**Steps to Reproduce**

1. Generate a .NET gadget chain payload using a tool like ysoserial.net (e.g., targeting TypeConfuseDelegate or another available gadget chain).
2. Send an HTTP POST request to the `/Orders/Restore` endpoint with the raw binary payload in the request body.
3. The server will deserialize the payload, executing the embedded commands.

Acceptance criteria:
- Acceptance is defined by the **actual reported behavior**, not by tests passing.
- Reproduce the issue, or narrow the exact code path that produces it, *before* changing code. State what you confirmed.
- Fix the underlying cause. Mitigations that paper over the reported behavior do not count as a fix.
- Add a regression test that fails on the unpatched code and passes on the fix. If a regression test is genuinely impractical (e.g. race condition, infra-level issue), say so and explain why.
- Existing tests passing is **not** the bar. Do not declare done on tests-pass theatre.

Only change what is necessary to fix this vulnerability. Do not refactor adjacent code or modify unrelated files.

---

_{Triage: Reply !fp <reason> (false positive), !valid (confirmed), !accepted_risk <reason>, or !fixed (resolved). Any other reply is saved as a triage note.
Reason is optional but improves future scans — e.g. !fp internal endpoint, not user-facing.}

_{View finding in Hacktron}