Conversation
- Require a valid admin bearer token to access the debug endpoint (previously unauthenticated, dumping every user's plaintext password and admin flag to anyone). - Enforce auth at both the OpenAPI layer (bearerAuth security requirement, matching other protected routes) and inside debug() itself (403 for authenticated non-admins). - Stop serializing the plaintext password field at all in User.json_debug(), even for admins - full account dumps should never echo raw credentials back over the wire. Fixes challenge 5 (API3:2019 Excessive Data Exposure). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
🏆 VAmPI — CTF Patch Score1 / 9 challenges patched
Commit: 🎉 Your result is on the leaderboard — see where you rank! 🏆 |
Author
beanbeah
deleted the
ctf/challenge-5-excessive-data-exposure-debug-endpoint
branch
August 9, 2026 13:57
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vulnerability
API3:2019 Excessive Data Exposure —
GET /users/v1/_debugwas completely unauthenticated and returned every user's username, email, plaintext password, and admin flag to anyone, regardless of thevulnflag.Fix
api_views/users.pydebug(): now validates the caller's bearer token and requiresrequester.adminto be true, returning 401 for missing/invalid tokens and 403 for authenticated non-admins.openapi_specs/openapi3.yml: declaredbearerAuthsecurity requirement on this path (consistent with other protected admin-only routes like delete_user), added 401/403 responses, and removed thepasswordfield from the documented response schema.models/user_model.pyUser.json_debug(): stopped serializing the plaintextpasswordfield entirely — even an authorized admin-only dump should never echo raw credentials back over the API.Testing
Built and ran the app locally in WSL (vulnerable=1, seeded via /createdb):
GET /users/v1/_debug→ 401 (previously 200 with full user dump including plaintext passwords).name1) → 403 "Only Admins may access debug data!".GET /users/v1(public basic list) andGET /users/v1/{username}both unaffected.🤖 Generated with Claude Code