[userTypeFix]: Privilege Escalation through login mutation Response Interception

[krishna619]

Describe the bug
In the Talawa Admin dashboard where intercepting and modifying the response to the login mutation can escalate privileges. Specifically, changing the isSuperAdmin value to true in the intercepted response grants super admin privileges to the user. This issue poses a significant security risk, allowing unauthorized access to super admin functionalities.

To Reproduce
Steps to reproduce the behavior:

1. Log in to the Talawa Admin dashboard as an admin.
2. Intercept the network response to the login mutation.
3. Modify the isSuperAdmin field value from false to true.
4. Observe that the user session now has super admin privileges.

Expected behavior
The application should securely validate user privileges on the server side, preventing the escalation of privileges through client-side manipulation.

Screenshots

Burp.Suite.Professional.v2023.12.1.2.-.Temporary.Project.-.Licensed.to.Zer0DayLab.Crew.2024-03-27.00-29-35.mp4

Additional details
Add any other context or screenshots about the feature request here.

Potential internship candidates
Please read this if you are planning to apply for a Palisadoes Foundation internship PalisadoesFoundation/talawa#359

[krishna619]

@palisadoes please add the userTypeFix tag.

[palisadoes]

Is this opened in the correct repo?

[krishna619]

@palisadoes hey I feel that this should come under admin repo, closing this and creating one in the admin repo.
I have fixed it, please assign this to me

[Cioppolo14]

Closed this as the issue was moved to admin.