User ID controlled by request parameter with data leakage in redirect
User ID controlled by request parameter with data leakage in redirect: This lab contains an access control vulnerability where sensitive information is leaked in the body of a redirect response. • PortSwigger • Access control vulnerabilities • params, redirect
Lab Walkthrough: Access Control Vulnerability – API Key Disclosure
🎯 Objective
This lab contains an access control vulnerability where sensitive information is leaked in the body of a redirect response.
Goal:
- Obtain the API key for the user
carlos - Submit it as the solution.
📝 Provided Information
- Valid credentials:
wiener:peter
🔎 Analysis
Step 1: Log In
Logged in as wiener with the provided credentials.
Step 2: Inspect Parameters
Checked the account-related requests and spotted a parameter in the request:
The vulnerable endpoint looked like this:
GET /my-account?id=wienerStep 3: Exploit the Access Control Flaw
Replaced wiener with carlos in the request:
GET /my-account?id=carlosThis exposed the API key for carlos in the response body.
🎉 Result
Successfully retrieved the API key for carlos via insecure direct object reference (IDOR) caused by broken access control. ✅