URL-based access control can be circumvented

Bypassing Front-End Restrictions with X-Original-URL

🎯 Objective

This lab uses a front-end system to block access to /admin, but the back-end supports the X-Original-URL header.
To solve the lab, use this header to bypass restrictions and delete the user carlos.

🧭 Strategy

• The front-end restricts direct access to /admin.
• Back-end routing via the X-Original-URL header may bypass it.
• Inject this header to reroute requests server-side while preserving front-end restrictions.

🔎 Analysis

1. 🧪 Test Header Injection

First, test with a dummy path to confirm if the back-end accepts header overrides:

X-Original-URL: /doesnotexist/

This checks if the back-end is influenced by the injected path.

2. 🛠️ Access the Admin Panel

Update the header with the real endpoint:

X-Original-URL: /admin

This bypasses the front-end restrictions and reveals the admin panel.

3. ⚠️ Handling Parameters

Since X-Original-URL doesn’t support query parameters directly, pass them in the main request path:

GET /?username=carlos HTTP/2
X-Original-URL: /admin/delete

This routes the request to /admin/delete while supplying username=carlos via query parameters.

4. ✅ Carlos Deleted

Final crafted request successfully deletes the user carlos.

📝 Action Plan

1. Log in and intercept a request.
2. Add the header:
   http Copy

   X-Original-URL: /admin

3. Confirm access to the admin panel.
4. Craft the final request:
   http Copy

   GET /?username=carlos
   X-Original-URL: /admin/delete

5. Send the request and verify carlos is deleted.