Finding ID: BAC-Portswigger-001

Title: Unprotected Admin Functionality

Risk (Severity): High

Rationale:

The application exposes an administrative interface that is accessible without authentication. The admin panel path is disclosed through the robots.txt file and is not protected by any server-side authorization checks. An attacker can directly access the admin panel and perform sensitive actions such as deleting user accounts, leading to full compromise of the application.

Affected asset / Location:
/administrator-panel (Admin panel endpoint)

Root cause:
Missing authentication and authorization checks on administrative functionality. The application relies on obscurity instead of enforcing proper access control.

Discovery date: 2025–12–30

Executive Summary :

The application contains an unprotected admin panel that can be discovered by viewing the robots.txt file. Any unauthenticated user can access the admin interface and execute privileged actions, including deleting users. This represents a clear case of Broken Access Control and allows complete administrative takeover of the application.Press enter or click to view image in full size

Reproducible Steps (PoC — Lab Only) :

1. First, open the target lab in a browser, read lab description carefully.

2. Next, access the lab …

3. Append /robots.txt to the lab URL:

4. Observe that the file reveals a hidden admin path:

Disallow: /administrator-panel

5. Replace /robots.txt with the disclosed path:

https://LAB-ID.web-security-academy.net/administrator-panel

6. Confirm that the admin panel loads without authentication and locate the user list.

7. Click Delete next to the user carlos.

8. The user is successfully deleted, solving the lab.

Impact :

• Unauthorized access to administrative functionality
• Ability to delete or modify user accounts
• Full compromise of application security
• Clear exploitation of Broken Access Control

Remediation (Recommended) :

1. Enforce Authentication
   Require login before accessing any admin endpoints.
2. Implement Authorization Checks
   Ensure only privileged users can perform administrative actions.
3. Do Not Rely on robots.txt
   robots.txt must never be used to protect sensitive paths.
4. Apply Role-Based Access Control (RBAC)
   Validate permissions on every sensitive request.
5. Regular Security Testing
   Include access control testing in security assessments.

References :

• OWASP Top 10 — A01: Broken Access Control
• https://owasp.org/Top10/A01_2021-Broken_Access_Control/
• https://portswigger.net/web-security/access-control

Written by Zeyad Naguib,
🔗 https://www.linkedin.com/in/zeyadnageeb
✍️ https://medium.com/@zeyadnaguib1