Privilege Escalation Worth $$$ Bounty

mohaned haron

2 min read

·

Mar 20, 2025

--

1

Listen

Share

Hello everyone, I’ll share how I found an improper access control vulnerability and earned a three-digit bounty. Let’s get started!

About the Target

The target system had two roles:

1. Admin/Owner — Full control over the organization.
2. User — Limited permissions, unable to edit personal details like name and email.

Press enter or click to view image in full size

Finding the Vulnerability

While reviewing the Swagger UI, I discovered an endpoint that allows updating a user’s name and email within the organization. However, this request required multiple parameters that a normal user wouldn’t typically have access to.

PATCH /odata/Users(USER_ID) HTTP/2
Host: redirect.com
Cookie: value
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) 
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Content-Length: 153
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers

{"key":key_value,
"DirectoryIdentifier":"value",
"domain":"value",
"LastLoginTime":"value",
"CreationTime":"value",
"Password":"value",
"TenantKey":"value",
"LicenseType":"value",
"Id":value,
"Name":"value","Surname":"value","UserName":"value",
"FullName":"value","EmailAddress":"value"
}

Exploitation Process

1. Removing Parameters

• As an admin, I started removing parameters one by one to see if the request would still work.
• I removed the "key" parameter and sent the request → 200 OK (User info changed).
• I then removed all unnecessary parameters and kept only the following

"Name":"value","Surname":"value","UserName":"value",
"FullName":"value","EmailAddress":"value"

Get mohaned haron’s stories in your inbox

Join Medium for free to get updates from this writer.

Subscribe

Subscribe

Remember me for faster sign in
• Sent the request → 200 OK (User info changed).

2. Privilege Escalation

• I changed the admin cookie in the request to a user cookie and sent it again.
• Response: 200 OK (My info changed as a low-privileged user!)

3. Enumerating User IDs

• The id field in the request was a numeric value (e.g., 3440).
• A normal user could not see or retrieve this ID from anywhere.
• I decided to fuzz the user IDs using ffuf

ffuf -request request.txt -w /usr/share/wordlists/SecLists/Fuzzing/4-digits-0000-9999.txt -c -mc all -fc 403

• Since there was no rate limit, I successfully retrieved my own user ID with a low-privileged account.

Reporting & Bounty

I submitted the report, but unfortunately, it was marked as a duplicate (internally known issue). However, I still received a bonus payout of $$$ bounty for my findings!

Press enter or click to view image in full size

Key Takeaways

• Swagger UI can expose sensitive endpoints — always review it carefully.
• Removing parameters can help bypass restrictions.

Happy hunting! 🐞🎯