Discoveries
Tool findings that matched no injected vulnerability. On a real application some of these may be genuine bugs a tool found by accident, so they are kept here for review with any proof of concept the tool supplied, rather than discarded as false positives.
6 unmatched findings, 0 with a proof of concept.
app.py:16200 CWE-200Smoke Test Challenge / effractor / run / Aug 29, 08:45 PM
Gadget endpoints expose sensitive environment variables without authentication
app.py:19CWE-306 Missing Authentication for Critical FunctionSmoke Test Challenge / effractor / run / Aug 29, 08:45 PM
The do_GET method exposes sensitive flags from environment variables through unauthenticated HTTP endpoints (/gadget/g1, /gadget/g2, /stage/1, /stage/2). No authentication or authorization is implemented, allowing any user to retrieve flags by simply accessing these endpoints. The /stage/2 endpoint has a token check, but the required token is itself exposed through the unauthenticated /stage/1 endpoint.
app.py:25CWE-284 Missing Access ControlSmoke Test Challenge / effractor / run / Aug 29, 08:37 PM
The /stage/1 endpoint (line 25-26) directly returns the flag from environment variable EF_FLAG_STAGE_1 without any authentication or authorization check. This flag is then used as a token to access /stage/2, creating a broken authentication chain. Lines 21-24 also expose /gadget/g1 and /gadget/g2 flags without authentication.
app.py:20CWE-22 Path TraversalGeneric Web #1 / effractor / run / Aug 29, 07:43 PM
The normalize_name function uses name.replace("../", "") which only performs a single-pass replacement. This allows attackers to bypass the filter using patterns like "..././" which become "../" after replacement, enabling directory traversal to read arbitrary files such as /proc/self/environ containing environment variables with sensitive flags.
app.py:14CWE-306 Missing Authentication for Critical FunctionSmoke Test Challenge / effractor / run / Aug 27, 07:08 PM
The do_GET method in app.py exposes sensitive flags through HTTP endpoints (/gadget/g1, /gadget/g2, /stage/1, /stage/2) without any authentication or authorization checks. Any user can directly access these endpoints to retrieve flag values from environment variables.
app.py:15CWE-306 Missing Authentication for Critical FunctionSmoke Test Challenge / effractor / run / Aug 27, 07:08 PM
The application exposes multiple sensitive endpoints (/gadget/g1, /gadget/g2, /stage/1, /stage/2) that return flags from environment variables without requiring any authentication or authorization. Lines 15-27 in app.py directly return flag values from os.environ without validating user identity or permissions, allowing unauthorized access to sensitive data.