webPromedium

YOFA 2.0

bug-makers

Task: Node.js/Express password manager with JWT auth, admin bot (Puppeteer), and CSRF protection. Vulnerability is client-side parameter pollution where duplicate query params are parsed differently by server (parseInt on array) vs client (last value from getAll). Solution: craft URL with two id params — first passes server auth, second causes client-side fetch to traverse path to /admin/addAdmin, promoting attacker's user to admin via the bot's session.

$ ls tags/ techniques/
ssrfpath_traversaljwtnodejsejspostgresqlexpressprivilege_escalationcsrfadmin_botpuppeteerclient_side_parameter_pollution
client_side_parameter_pollution_via_duplicate_query_paramsrelative_path_traversal_in_fetchadmin_bot_csrf_exploitationjwt_role_escalation_via_reloginparseint_array_coercion
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups