User ID controlled by request parameter with data leakage in redirect

Description

This lab contains an access control vulnerability where sensitive information is leaked in the body of a redirect response.

Reproduction and proof of concept

1. Log in with wiener:peter and access the account page.

2. Send the request to Burp Repeater.

3. Change the “id” parameter to carlos.

4. Observe that although the response is now redirecting you to the home page, it has a body containing the API key belonging to carlos.

5. Submit the API key.

Exploitability

An attacker will need to log in, obtain the API key for the user carlos and submit it as the solution.