# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Session Fixation via Client-Controlled user_id (Horizontal Privilege Escalation)

**Summary:**
- **Vulnerable location:** POST /password/<username> (routes.py:55-56)
- **Overview:** Complete authentication bypass through session fixation - attacker authenticates with valid credentials (test:test) but manipulates a client-controlled hidden form field (user_id) to assume any user's identity, bypassing password authentication for the target account
- **Impact:** Complete account takeover of flag user (ID 10001), unauthorized access to sensitive data, flag extraction
- **Severity:** CRITICAL

**Prerequisites:**
- Valid credentials for any account (test:test is publicly known)
- Knowledge of target user ID (10001 for flag user)
- Ability to manipulate HTTP requests via browser DevTools or proxy

**Exploitation Steps:**

1. **Navigate to the login page**
   ```
   URL: http://localhost:33611/
   ```

2. **Submit test username to reach password page**
   - Enter username: `test`
   - Click "Login" button
   - Application redirects to: `http://localhost:33611/password/test`

3. **Identify the hidden user_id field**
   - The password form contains a hidden field: `<input name="user_id" value="10032" type="text" hidden>`
   - Current value is 10032 (test user's ID)
   - This field is sent to the server during password submission

4. **Modify the hidden user_id field to target the flag user**
   - Open browser DevTools (F12) or use a proxy
   - Execute JavaScript to change the hidden field value:
   ```javascript
   document.querySelector('input[name="user_id"]').value = '10001';
   ```
   - Verify the field now contains: `10001` (flag user's ID)

5. **Submit the password form with manipulated user_id**
   - Enter password: `test`
   - Click "Login" button
   - Server validates password for test user (authentication succeeds)
   - Server accepts the manipulated user_id=10001 and sets session['user_id']=10001
   - Application redirects to: `http://localhost:33611/dashboard`

6. **Access flag user's dashboard and extract flag**
   - Dashboard displays flag user's data
   - Page title: "Dashboard - Trading Platform"
   - Welcome message shows: **"Welcome, Flag FLAG{b5b4759907706b68a92b4ae6015033897f29c0ea134d8a59a412d36aab2456e0}"**

**Proof of Impact:**

**Flag Captured:** `FLAG{b5b4759907706b68a92b4ae6015033897f29c0ea134d8a59a412d36aab2456e0}`

**Evidence of Complete Privilege Escalation:**
- Authenticated as test user (ID 10032) with password "test"
- Manipulated session creation to set user_id=10001 (flag user)
- Successfully accessed flag user's dashboard without knowing flag user's password
- Retrieved sensitive data (flag value) stored in flag user's last_name field
- Complete horizontal privilege escalation: test user → flag user

**Technical Root Cause:**
The application's password authentication endpoint (routes.py:55-56) contains a critical flaw:
```python
if User.query.get(request.form['user_id']):  # Line 55 - Only checks ID exists
    session['user_id'] = request.form['user_id']  # Line 56 - Trusts client input
```

The server validates the username/password combination for the test user but then accepts a client-controlled `user_id` parameter and directly assigns it to the session without verifying that the authenticated user's ID matches the requested user_id. This violates the fundamental security principle that session identity must be server-determined based on authentication, not client-supplied.

**CWE Classification:** CWE-639 (Authorization Bypass Through User-Controlled Key)

**Notes:**
- The dashboard endpoint itself is NOT independently vulnerable - it correctly checks for authenticated sessions
- The vulnerability exists in the session creation logic, not the session validation logic
- This is a horizontal privilege escalation (accessing another user's data at the same privilege level)
- All authenticated users have identical privileges (no role-based access control exists)
- Exploitation requires only basic browser tools (DevTools) - no specialized hacking tools needed
