In this exercise you will audit the source code of the given application for security vulnerabilities. Add your findings in the WRITE-UP.md file and send it back by email.
You need to install Docker to run the application.
This application allows a user to register one or multiple accounts with a unique username and link a public avatar to this username. All pages are meant to be public except the page to edit an avatar.
There is a limited amount of vulnerabilities to find. All of them are exploitable.
Here is a list of potential security problems in this application that you should not report:
- Application only accessible through HTTP
- Vulnerabilities in dependencies or the Docker image itself
- Missing security headers
- Missing brute force protection, rate limiting, or captchas
- User enumeration
- Hard-coded credentials
- Publicly accessible pages