Application Security Assessment

Overview

This is a security assessment exercise for a Senior Application Security Engineer position. The application is a simple document management API with intentional security vulnerabilities that you need to identify and analyze.

Setup

npm install
npm run dev

The server will start on http://localhost:3000

Test Credentials

• Admin: admin / admin123
• User 1: john / user123
• User 2: jane / user123

API Endpoints

Authentication

• POST /api/login - User login

  {"username": "admin", "password": "admin123"}

Documents

• GET /api/documents - List documents
• GET /api/documents/:id - Get specific document
• POST /api/upload - Upload file
• GET /api/download/:filename - Download file

User Management

• PUT /api/profile - Update user profile

  {"email": "new@email.com", "role": "admin"}

Your Task

Find and document the security vulnerabilities in this application.

Requirements

1. Identify vulnerabilities - Find security issues in the code
2. Classify severity - Rate each vulnerability (Critical/High/Medium/Low)
3. Provide proof of concept - Show how to exploit each vulnerability
4. Recommend fixes - Suggest specific remediation steps

Expected Deliverable

A security assessment report containing:

• Executive summary
• Detailed vulnerability findings
• Risk assessment and prioritization
• Remediation recommendations

Time Limit

2-3 hours maximum

Example Requests

Login

curl -X POST http://localhost:3000/api/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": "admin123"}'

Access Documents

# Get token from login response first
curl -X GET http://localhost:3000/api/documents \
  -H "Authorization: Bearer YOUR_TOKEN"

Upload File

curl -X POST http://localhost:3000/api/upload \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -F "file=@test.txt"

Evaluation Criteria

• Completeness: How many vulnerabilities you identify
• Accuracy: Correct classification and impact assessment
• Technical depth: Quality of analysis and proof of concepts
• Communication: Clear, professional documentation
• Remediation: Practical and effective fix recommendations

Good luck! 🔒