Root + Impact

Description

• Describe the normal behavior in one or more sentences

  Answer: The set_secret function is designed to allow a user to store or update their own secret securely in the system. Ideally, only authorized users should be able to set or modify their own data.

  
  

• Explain the specific issue or problem in one or more sentences
  Answer: The function lacks any authentication or authorization checks, meaning any user can set or overwrite secrets for any other user. This opens the door to privilege escalation and data corruption.

Risk

Likelihood:

• Reason 1 // Describe WHEN this will occur (avoid using "if" statements)

  This occurs whenever a malicious actor directly calls set_secret with another user's identifier.

  
  

• Reason 2

  Because there are no restrictions, automated scripts or insiders can exploit this consistently without detection.

Impact:

• Impact 1

  Attackers can overwrite sensitive secrets of legitimate users, corrupting system integrity.

  
  

• Impact 2

  Privilege escalation enables attackers to impersonate privileged users by setting fake secrets on their behalf, leading to unauthorized access to critical resources.

Proof of Concept

I am demonstrating how an attacker can set a secret for another user without their knowledge or permission, effectively hijacking their account or privilege.

Here, the attacker bypasses any need to authenticate as "admin" and simply sets the admin’s secret directly. This proves that privilege escalation is possible because there is no check on which user is allowed to call set_secret.

Recommended Mitigation

The fix ensures that users can only update their own secrets, preventing them from overwriting secrets belonging to others. For more advanced security, role-based access control (RBAC) or an access control list (ACL) can be added to allow privileged accounts to manage secrets securely.