Privilege Escalation to Admin Analytics

Summary

The administrative endpoint /api/admin/votes/timeline was incorrectly protected. While requiring authentication, it failed to verify the user’s role, allowing standard users to access admin-only analytics.

Vulnerability Details

The endpoint required a valid JWT but did not check the isAdmin flag or user role.

Authentication vs Authorization

┌─────────────────────────────────────────────────────┐
│                 Security Check Flow                  │
├─────────────────────────────────────────────────────┤
│                                                     │
│  ✅ Step 1: Is user logged in? (JWT valid?)        │
│     └── Implemented correctly                       │
│                                                     │
│  ❌ Step 2: Is user authorized? (isAdmin?)         │
│     └── MISSING!                                    │
│                                                     │
└─────────────────────────────────────────────────────┘

Proof of Concept

A standard user (permission level 0) could query admin endpoints:

GET /api/admin/votes/timeline HTTP/1.1
Host: target.com
Authorization: Bearer <standard_user_jwt>

Response (Admin Data Exposed)

{
  "timeline": [
    { "hour": "2025-11-02T10:00", "votes": 234 },
    { "hour": "2025-11-02T11:00", "votes": 567 },
    { "hour": "2025-11-02T12:00", "votes": 891 }
  ],
  "peakHour": "14:00",
  "totalToday": 4521,
  "avgPerHour": 376
}

JWT Analysis

// Standard user JWT payload
{
  "userId": "user123",
  "email": "user@example.com",
  "isAdmin": false,        // ← Not checked by server!
  "iat": 1698912000,
  "exp": 1698998400
}

Impact

• Unauthorized insight into administrative data
• Exposure of voting behavioral patterns
• Strategic advantage for malicious users
• Potential data scraping for competitive analysis

Remediation

// Proper role-based access control
const adminOnly = (req, res, next) => {
  if (!req.user.isAdmin) {
    return res.status(403).json({ error: 'Admin access required' });
  }
  next();
};

router.get('/admin/votes/timeline',
  authMiddleware,
  adminOnly,  // Add role check
  timelineController
);