Multistep process with no access control on one step

Description

This lab has an admin panel with a flawed multi-step process for changing a user’s role. You can familiarise yourself with the admin panel by logging in using the credentials administrator:admin.

Reproduction and proof of concept

1. Log in using the admin credentials administrator:admin.

2. Browse to the admin panel, promote carlos, and send the confirmation HTTP request to Burp Repeater.

3. Open a private/incognito browser window, and log in with the non-admin credentials wiener:peter.

4. Copy the non-admin user’s session cookie into the existing Repeater request, change the username to yours, and replay it.

Exploitability

An attacker will need to exploit the flawed access controls to become an administrator.