Before demonstrating the vulnerability i would like to explain what is Vertical Privilege Escalation

Vertical Privilege Escalation

It’s one form of the broken access control vulnerability that makes the user with low privilege access to gain the access to do the actions beyond what they were supposed to do

One day I was testing one human resource management web app. To tell about webapp, it is an application where the information of the employees in an organization is stored and managed effectively. Each and every employees assigned with different roles based on the tier levels in the company

I was given test login credentials of an two accounts with the different privileges ,Lets say the two accounts be reportee and a reporting manager

Using the provided credentials ,First I logged in as reportee and played around the different features in an application

While testing I noticed one of the feature “Leave Request” where reportees able to request the leave from their corresponding reporting managers and the reporting managers able to approve or reject the reportee’s leave request

Using reportee account i made leave request to his reporting manager

While clicking the submit button i found the api using the chrome dev tool

Method: POST
I got the response like this

Proof of Exploitation

My Curious mind kicks in that what if I intentionally injected the parameter “status”:”Approved” in the post request and see what happens next

So I again requested the leave for the different date

But this time i’m going to intercept the post request in burp suite tool

As mentioned earlier now let’s inject the parameter value “status”:”Approved” in the POST request and see how it behaves

After exploitation here is how the changes being reflected from pending to approved status in the UI level from reportee leave request model

Here is the screenshot taken from the reporting manager leave request model in which the reportee’s leave request had been approved without the knowledge of reporting manager

Hahaha!!!😂😂

Steps To Reproduce

1. Go to redacted.com (I’m not supposed to say the name of the web app)
2. Login as reportee
3. Click Leave request
4. Fill the Leave request form
5. Turn the intercept on in burp suite
6. Addionally add “status”:”Approved” in the post request
7. Forward it and see the response that reportees leave request had approved without reporting managers knowledge

In my view what’s causing this broken access control issue is instead of validating the user input backend blindly accepting the payload and acted upon it without proper authorization checks.If any reportee were aware of this vulnerability they need not to get leave request approval from their reporting manager instead they can approve their leave request on their own HAHAHA!!! 😂😂Jokes apart I reported this vulnerability to the consent platform and they started to fix it

If you find this writeup helpful to you please follow me for more writeups like this. See you all in next writeup!!!