EH-20: API Authorization Bypass - Akses Endpoint Terproteksi

cd ~ && mkdir -p eth-l20 && cd eth-l20
cat > server.py << 'PYEOF'
from flask import Flask, request, jsonify
app = Flask(__name__)
@app.route('/api/v1/users')
def v1():
    return jsonify([{"name":"admin","role":"admin"}])
@app.route('/api/v2/users')
def v2():
    auth = request.headers.get('Authorization')
    if not auth: return jsonify({"error":"auth required"}),401
    return jsonify([{"name":"admin","role":"admin"}])
@app.route('/api/v3/users')
def v3():
    return jsonify([{"name":"admin","role":"admin","password":"flag{API_Bypass}"}])
app.run(port=9018)
PYEOF
python3 server.py &
sleep 1

echo "=== v1: No Auth ==*"
curl -s http://localhost:9018/api/v1/users
echo ""
echo "=== v2: Auth Required ==*"
curl -s http://localhost:9018/api/v2/users
echo ""
echo "=== v3: Old version with password! ==*"
curl -s http://localhost:9018/api/v3/users

kill %1 2>/dev/null