Vulnerability Documentation & Lab Guide
This documentation provides an in-depth technical analysis of all intentionally introduced vulnerabilities in VulnShop. Watch the proof-of-concept videos and follow the steps to reproduce them.
1. IDOR (Insecure Direct Object Reference)
CRITICALDescription & Root Cause
The /api/orders/:id endpoint retrieves order details based on the ID passed in the URL. However, it fails to verify if the currently authenticated user actually owns that order.
Step-by-Step Exploitation
# Step 2: Log in as User A and place an order. Note the order ID (e.g., Order ID 1).
# Step 3: Log out and log in as User B. Place an order (e.g., Order ID 2).
# Step 4: Navigate to User A's order endpoint:
URL: http://vulnshop.yogsec.net/api/orders/1
# Result: The server returns User A's order details to User B.
Remediation
Always enforce authorization checks at the API level. The SQL query must include the user's ID: SELECT * FROM orders WHERE id = ? AND user_id = ?.
2. Business Logic Flaw (Negative Quantity)
CRITICALDescription & Root Cause
The backend validation logic for order placement fails to enforce that the item quantity must be a positive integer greater than zero.
Step-by-Step Exploitation
# Step 2: Turn on Burp Suite Intercept to capture the
POST /api/orders request.# Step 3: Modify the JSON body. Change to: "items": [{"id": 7, "quantity": -10}]
# Step 4: Forward the request.
# Result: The total amount becomes negative, and stock increases.
Remediation
Implement strict server-side validation: if (quantity <= 0 || !Number.isInteger(quantity)) throw new Error("Invalid quantity");.
3. Reflected XSS (Cross-Site Scripting)
HIGHDescription & Root Cause
The search functionality reflects the user's query back into the DOM using innerHTML without sanitization.
Step-by-Step Exploitation
# Step 2: Enter the payload: <img src=x onerror="alert('XSS by YogSec')">
# Step 3: Press Enter.
# Result: The browser executes the script and displays a popup.
Remediation
Never use innerHTML with user input. Use textContent or implement a strict sanitization library like DOMPurify.
4. SQL Injection (SQLi) - Simulation
CRITICALDescription & Root Cause
The product search API concatenates user input directly into the SQL query. (Simulated safely for the lab environment).
Step-by-Step Exploitation
# Step 2: Enter the payload: ' OR 1=1 --
# Step 3: Press Enter.
# Result: The application dumps all products and displays a red warning.
Remediation
Use parameterized queries (Prepared Statements) for all database interactions.
5. Privilege Escalation (Admin Access)
CRITICALDescription & Root Cause
The application checks a client-side URL parameter (?admin=true) to grant administrative privileges.
Step-by-Step Exploitation
# Step 2: Append the parameter to the URL: http://vulnshop.yogsec.net/?admin=true
# Step 3: Press Enter.
# Result: The user's name turns red with an [ADMIN] tag and unlocks the dashboard.
Remediation
Authorization must be enforced strictly on the server-side using the user's session. Never rely on client-side parameters.
6. Path Traversal (Directory Traversal)
HIGHDescription & Root Cause
The invoice download API takes a filename from the user and lacks validation to ensure the user cannot traverse upwards using ../.
Step-by-Step Exploitation
# Step 2: Intercept with Burp Suite.
# Step 3: Modify the URL to: /api/download?file=../../server.js
# Step 4: Forward the request.
# Result: The server traverses out and returns the source code.
Remediation
Use path.basename() to strip directory components and enforce that the resolved path remains within the intended directory.
7. Broken Access Control (Cart Manipulation)
HIGHDescription & Root Cause
The API endpoint /api/cart/:userId accepts a user ID in the URL to update cart data without verifying if the session user matches the requested ID.
Step-by-Step Exploitation
# Step 2: Intercept the POST request in Burp Suite.
# Step 3: Change the URL to victim's ID: POST /api/cart/2
# Step 4: Inject arbitrary items and forward.
# Result: The server overwrites the victim's cart.
Remediation
Do not accept userId from the URL for authenticated actions. Extract the user ID directly from the server-side session.
8. Insecure File Upload
HIGHDescription & Root Cause
The avatar upload endpoint uses Multer but lacks a file filter or extension validation. It accepts any executable script.
Step-by-Step Exploitation
# Step 2: Instead of an image, select a script file (e.g.,
shell.py).# Step 3: The upload completes successfully.
# Result: The server accepts a potentially malicious executable file.
Remediation
Implement strict validation. Check the MIME type and whitelist acceptable extensions (e.g., .jpg, .png).
9. Username Enumeration
MEDIUMDescription & Root Cause
The login API returns distinct error messages depending on whether the email exists in the database.
Step-by-Step Exploitation
# Step 2: Enter a non-existent email. Error: "Email not found".
# Step 3: Enter a valid email with a wrong password. Error: "Incorrect password".
# Result: An attacker can determine which emails are valid users.
Remediation
Use generic error messages: return res.status(401).json({ message: "Invalid email or password." });.
10. Login Bruteforce (No Rate Limiting)
HIGHDescription & Root Cause
The login endpoint lacks rate-limiting, account lockout mechanisms, or CAPTCHAs. An attacker can make unlimited login attempts.
Step-by-Step Exploitation
# Step 2: Capture the
POST /api/login request in Burp Suite.# Step 3: Send to Burp Intruder and load a wordlist.
# Step 4: Start the attack.
# Result: The server processes every request without blocking.
Remediation
Implement rate limiting (e.g., express-rate-limit), enforce account lockout after 5 failed attempts, and introduce CAPTCHAs.