webProeasy

TeamPulse — Broken Authorization in Team Invitation Roles

hackadvisor

Task: Free-tier workspace with client-side role restrictions on team invitations; Pro roles (analyst/manager) disabled in UI dropdown. Solution: bypass client-side restriction by sending POST to invitation API with premium role, register invited user, accept invitation, access Pro-only analytics dashboard containing the flag.

nodejs express broken_access_control rbac team_management subscription_bypass tier_bypass honeypot_decoy role_tampering client_side_restriction

parameter_tamperingsubscription_tier_bypassdecoy_flag_evasionclient_side_restriction_bypassrole_escalation_via_invitation

$ ls tags/ techniques/

nodejs express broken_access_control rbac team_management subscription_bypass tier_bypass honeypot_decoy role_tampering client_side_restriction

parameter_tamperingsubscription_tier_bypassdecoy_flag_evasionclient_side_restriction_bypassrole_escalation_via_invitation

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ cat writeup.md…

Sign in to access full writeups

Sign in to access full writeups

Similar writeups