S083 · OWASP Top 10, Secrets Mgmt & Threat Modelling

# vuln_api.py — DELIBERATELY vulnerable. Never run on a public port.
# Educational only. All fixes shown in comments.
from flask import Flask, request, jsonify, g
import sqlite3, os, subprocess, requests
 
app = Flask(__name__)
DB = "app.db"
 
# --- setup: create a tiny DB with 2 users ---
def init_db():
    conn = sqlite3.connect(DB)
    conn.executescript("""
      DROP TABLE IF EXISTS users;
      CREATE TABLE users (id INT, name TEXT, email TEXT, is_admin INT);
      INSERT INTO users VALUES
        (1, 'alice', 'alice@example.com', 0),
        (2, 'bob',   'bob@example.com',   1);
    """)
    conn.commit(); conn.close()
 
def db():
    if "db" not in g:
        g.db = sqlite3.connect(DB); g.db.row_factory = sqlite3.Row
    return g.db
 
# ================================================================
# A03 — SQL INJECTION (deliberately vulnerable)
# ================================================================
@app.get("/user_bad")
def user_bad():
    name = request.args.get("name", "")
    # ❌ String concatenation → SQLi.
    # Attack: /user_bad?name=' OR 1=1 --
    q = f"SELECT id, name, email FROM users WHERE name = '{name}'"
    rows = db().execute(q).fetchall()
    return jsonify([dict(r) for r in rows])
 
@app.get("/user_good")
def user_good():
    name = request.args.get("name", "")
    # ✅ Parameterised query — driver escapes for us.
    q = "SELECT id, name, email FROM users WHERE name = ?"
    rows = db().execute(q, (name,)).fetchall()
    return jsonify([dict(r) for r in rows])
 
# ================================================================
# A01 — BROKEN ACCESS CONTROL (IDOR)
# ================================================================
@app.get("/account/<int:uid>")
def account_bad(uid):
    # ❌ No check that current user == uid. Attacker guesses IDs.
    row = db().execute("SELECT * FROM users WHERE id = ?", (uid,)).fetchone()
    return jsonify(dict(row)) if row else ("not found", 404)
 
@app.get("/account_good/<int:uid>")
def account_good(uid):
    # ✅ Compare uid against authenticated identity (from JWT / session).
    current_uid = int(request.headers.get("X-User-Id", "0"))  # simplified
    if current_uid != uid:
        return ("forbidden", 403)
    row = db().execute("SELECT * FROM users WHERE id = ?", (uid,)).fetchone()
    return jsonify(dict(row)) if row else ("not found", 404)
 
# ================================================================
# A10 — SSRF
# ================================================================
@app.get("/fetch")
def fetch_bad():
    url = request.args.get("url", "")
    # ❌ Attacker points url at 169.254.169.254 → steals cloud metadata.
    r = requests.get(url, timeout=5)
    return r.text[:500]
 
# ✅ Fix: allowlist domains, or resolve DNS and reject private ranges,
#    or use an outbound proxy that enforces the allowlist.
 
# ================================================================
# A02 — SECRETS: bad vs good
# ================================================================
# ❌ Hard-coded — will end up in Git.
API_KEY_BAD = "sk_live_51H8xVjKk7ZQ1mA2X_never_do_this"
 
# ✅ From environment (better) — for real apps, fetch from Vault at startup.
API_KEY = os.environ.get("PAYMENTS_API_KEY", "not-set")
 
@app.get("/health")
def health():
    return jsonify(ok=True, api_key_loaded=(API_KEY != "not-set"))
 
if __name__ == "__main__":
    init_db()
    # Bind to localhost ONLY — this app is vulnerable by design.
    app.run(host="127.0.0.1", port=5000, debug=False)

# Terminal 2 — the attacker
BASE=http://127.0.0.1:5000
 
# A03 · SQL injection — leak all users
curl -s "$BASE/user_bad?name=' OR 1=1 --"
 
# Same attack on the good endpoint — returns []
curl -s "$BASE/user_good?name=' OR 1=1 --"
 
# A01 · IDOR — read Bob's admin account as anyone
curl -s "$BASE/account/2"          # ❌ works, no auth
curl -s "$BASE/account_good/2"     # ✅ 403 without X-User-Id: 2 header
curl -s -H "X-User-Id: 1" "$BASE/account_good/2"   # ✅ still 403, different user
 
# A10 · SSRF — attempt to fetch AWS metadata (won't work locally, but you get the idea)
curl -s "$BASE/fetch?url=http://169.254.169.254/latest/meta-data/"