Vulnerabilities in Referer-based access controls, Authorization series (Part 6)

Vipul Jain

5 min read

·

Jul 17, 2024

--

Listen

Share

Introduction

Some websites base access controls on the Referer header submitted in the HTTP request. This is an optional HTTP header that a browser sends along with certain requests to indicate the web page that initiated the request. It’s intended to help track how users navigate between pages on a website.

The vulnerability arises when websites base access control decisions solely on the Referer header. This means they only grant access to certain pages (like /admin/deleteUser) if the Referer header points to a previous authorized page (like the main admin panel /admin). Even though there is complete security check taking place over the /admin URL but there is no check implemented on the requests further and basing the security check only on Referer header.

The problem arises because attackers can manipulate the Referer header in their requests. This allows them to bypass the access control check:

• Example: Imagine an application allows deleting users only through the /admin/deleteUser page.
• Vulnerability: If the application only checks the Referer header and expects it to be /admin, an attacker can craft a direct request to /admin/deleteUser with a forged Referer header set to /admin.
• Impact: By manipulating the Referer header, the attacker tricks the application into granting access to a sensitive function (deleting users) without going through the intended access control process.

Referer VS X-Original-URL

The Referer header is similar to X-Original-URL header that was used to by pass access controls earlier but still there is subtle difference between the two.

Referer Header:

• Standardized: It’s an official HTTP header defined in the HTTP specification (RFC 1945). Most browsers automatically send it by default.
• Content: It specifies the URL of the web page that triggered the current request. This could be a link the user clicked, a form submission, or an embedded resource (image, script).

X-Original-URL Header:

• Non-Standard: This is a custom header not part of the official HTTP specification. It’s often used in specific frameworks or applications.
• Content: The intended purpose can vary depending on the implementation. It might:

Mirror Referer Header: In some cases, it might simply copy the value from the Referer header for internal tracking purposes within the application.

Override Referer: It could be used to provide a more reliable source of the original URL, especially in situations where the Referer header might be missing or unreliable.

Lab: Referer-based access control

Lab Description

This lab controls access to certain admin functionality based on the Referer header. You can familiarize yourself with the admin panel by logging in using the credentials administrator:admin.

To solve the lab, log in using the credentials wiener:peter and exploit the flawed access controls to promote yourself to become an administrator.

Login as the admin so that we can capture the admin panel request in burp suite. After logging in, visit the admin panel and here is the status of the users as shown below.

Now upgrade the user carlos to admin level and this captures the admin panel request in burp suite.

As can be seen below we have the admin panel request in burp suite with the GET method to upgrade the user carlos to admin level.

This image above shows the end point in the referer header is pointing towards admin path. We send this request to burp repeater.

Now login as user wiener.

As can be seen below we have the session id for user wiener, copy this as it will replace the admin user’s session id in the admin panel request so as to send the request from wiener’s account.

Now replace the admin user’s session id with wiener’s one and also ensure that the endpoint in referer header points to “/admin”. Further change the username to wiener from carlos as shown below.

Send this request and analyse the response.

Refresh the my-account page and as can be seen below that admin panel option can now be accessed from wiener’s account.

This confirms that wiener has been upgraded to admin level.

This means that the website only checked for the /admin path on the referer header while sending the request for the admin functionality, this is an unreliable access control method since any unauthorized user can modify the header and hence by-pass the access control.

Location-based access control

Some websites enforce access controls based on the user’s geographical location. This can apply, for example, to banking applications or media services where state legislation or business restrictions apply. These access controls can often be circumvented by the use of web proxies, VPNs, or manipulation of client-side geolocation mechanisms.

This marks the end of authorization series. The next series of blogs will be about file upload vulnerability and various labs based on the same from web security academy.