Method-based access control can be circumvented | Dec 14, 2022

Introduction

Welcome to my another writeup! In this Portswigger Labs lab, you'll learn: Method-based access control can be circumvented! Without further ado, let's dive in.

Overall difficulty for me (From 1-10 stars): ★☆☆☆☆☆☆☆☆☆

Background

This lab implements access controls based partly on the HTTP method of requests. You can familiarize yourself with the admin panel by logging in using the credentials administrator:admin.

To solve the lab, log in using the credentials wiener:peter and exploit the flawed access controls to promote yourself to become an administrator.

Exploitation

Home page:

Let's view the admin panel!

In here, administrator can upgrade or downgrade a user.

When we try to upgrade a user:

It's sending a POST request to /admin-roles, and with the username and action.

Now, let's log out and login as user wiener to do vertical privilege escalation!

Now, what if I intercept a request, modify the location to /admin-roles?

As you can see, looks like we can access /admin-roles when we're sending a GET request to /admin-roles without any parameters.

How about POST request?

Hmm… Unauthorized?

It seems like we're allowed to send a GET request to /admin-roles!!

Now, let's send a GET request to /admin-roles, with parameters: username=wiener&action=upgrade:

We've sucessfully escalated to administator!!

What we've learned:

Method-based access control can be circumvented