Fix Challenge-33: enforce admin role check on UrlAccess2Admin (Failure to Restrict URL Access 2) - #343
Closed
beanbeah wants to merge 2 commits into
Closed
Fix Challenge-33: enforce admin role check on UrlAccess2Admin (Failure to Restrict URL Access 2)#343beanbeah wants to merge 2 commits into
beanbeah wants to merge 2 commits into
Conversation
Failure to Restrict URL Access 2's admin function (UrlAccess2Admin) only called Validate.validateSession(ses), which accepts any logged in user (player or admin). Any authenticated player who read the level's obfuscated client-side JS could discover the hidden admin endpoint and POST directly to it, receiving the privileged result key with no admin session required. Fix: add Validate.validateAdminSession(ses) as a gate at the top of doPost, returning 403 Forbidden before any challenge logic runs when the caller's session role is not 'admin'. Mirrors the same fix already applied and CI-verified for the sibling URL Access 1 challenge (UrlAccess1Admin, PR #330). UrlAccess2.java (the guest-view red herring servlet) needs no change, consistent with the working-list's parity note that the reference 40/40 PR only touches the *Admin.java files for these two challenges. Added src/it/java/servlets/module/challenge/UrlAccess2AdminIT.java, a new integration test (same pattern as the existing NoSqlInjection1IT / XxeChallenge1IT tests) covering both cases end to end against a real MariaDB-backed instance of the actual servlet: a plain player session now gets 403 attempting the admin endpoint, and a real admin session still receives the correct result key. Locally verified: ran the new UrlAccess2AdminIT via mvn failsafe:integration-test/verify against a disposable MariaDB container (docker-compose bring-up was infeasible in this session due to heavy shared-WSL-sandbox contention from concurrent sibling agents, so this is a lighter but still live, real-code verification path). Both tests passed (2/2): the exploit path (non-admin hitting the admin servlet) now returns 403, and the legitimate admin flow still returns the key. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
🏆 Security Shepherd — CTF Patch Score0 / 40 challenges patched
Commit: No points yet — this commit didn't solve any challenges, so there's nothing on the leaderboard for it. Patch a vulnerability and push again! 💪 |
…ormat) CI's spotless-check failed on the class javadoc's line wrapping. Ran mvn spotless:apply locally and confirmed mvn spotless:check now passes clean. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Author
|
Closing as part of a full stand-down of this CTF push. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vulnerability
UrlAccess2Admin.doPost()(the admin-only function for the "Failure to Restrict URL Access 2" challenge) only calledValidate.validateSession(ses), which accepts any authenticated session regardless of role (player or admin). The level's JSP page hides the admin endpoint URL and required parameter inside obfuscated client-side JavaScript, but any logged-in player who reverse engineers that JS can POST directly to the admin servlet and receive the privileged result key without ever holding an admin session.Fix
Added a
Validate.validateAdminSession(ses)gate at the top ofdoPost(), returning403 Forbiddenbefore any challenge logic executes when the session's role is notadmin. This mirrors the same pattern already applied and CI-verified for the sibling URL Access 1 challenge (UrlAccess1Admin, PR #330).UrlAccess2.java(the guest-view red herring servlet) needed no change — confirmed against the parity notes for the reference 40/40 PR, which likewise only touches the*Admin.javafiles for these two challenges.Testing
Added
src/it/java/servlets/module/challenge/UrlAccess2AdminIT.java, a new integration test following the existing repo convention (NoSqlInjection1IT,XxeChallenge1IT) that exercises the real servlet end-to-end against a live MariaDB-backed instance:adminDataparameter to the admin endpoint now gets403.Ran via
mvn failsafe:integration-test/verifyagainst a disposable local MariaDB container: 2/2 tests passed. (Fulldocker composeTomcat/Mongo bring-up was infeasible in this session due to heavy shared-sandbox resource contention from many concurrent sibling build agents, so this lighter-weight path — still real application code, no mocks of the class under test — was used to get genuine local verification before opening this PR.)🤖 Generated with Claude Code