VulnLawyers
Difficulty Medium - Released Apr 21st, 2019 - Authors BuildHackSecure
The following post by 0xb0b is licensed under CC BY 4.0
I am submitting this write-up as a penetration test report for the competition organized by Tyler Ramsbey. If my entry is among the top three, I will respectfully withdraw from receiving any prizes (courses). However, I would be very grateful for public feedback, if it had been seen among the three candidates.
I used AI (ChatGPT/ DeepL) for formal expression due to my language barrier. Do not process any confidential / real customer data in online AI models! 😄
The Statement of Confidentiality, the Engagement Contact and the Rules of Engagement (see Executive Summary) are fictitious and derived from https://docs.sysreptor.com/assets/reports/HTB-CBBH-Report.pdf.
Pentest Report VulnLawyers Ltd.
Statement of Confidentiality
This document contains sensitive security assessment information pertaining to VulnLawyers and is intended solely for authorized personnel. The findings, analysis, and recommendations within this report are the result of a targeted bug bounty penetration test conducted under explicit authorization.
Unauthorized access, disclosure, reproduction, or distribution of this report, in part or in full, is strictly prohibited and may be unlawful. The information herein may include details related to system vulnerabilities, internal architecture, and user data, which, if misused, could compromise the security and integrity of VulnLawyers’ systems and operations.
All parties in possession of this report must handle it with the utmost confidentiality, in accordance with internal data handling and information security policies. Disclosure to third parties is prohibited without the express written consent of VulnLawyers’ security or legal teams.
Engagement Contacts
Shayne Cairns
Dr.
shayne.cairns@vulnlawyers.ctf
Yusef Mcclain
yusef.mcclain@vulnlawyers.ctf
Mathias Detmers
0xb0b
mathias.detmers@example.com
Executive Summary
VulnLawyers Ltd. invited Mathias Detmers to a private bug bounty program to perform a targeted Web Application Penetration Test of VulnLawyers's externally facing web applications to identify high-risk security weaknesses, determine the impact to VulnLawyers, document all findings in a clear and repeatable manner, and provide remediation recommendations. The following types of findings were in-scope for this private bug bounty program:
Sensitive or personally identifiable information disclosure
Cross-Site Scripting (XSS)
Server-side or remote code execution (RCE)
Arbitrary file upload
Authentication or authorization flaws, such as insecure direct object references (IDOR), and authentication bypasses
All forms of injection vulnerabilities Directory traversal
Local file read
Significant security misconfigurations and business logic flaws
Exposed credentials that could be leveraged to gain further access
The following types of activities were considered out-of-scope for this bug bounty program:
Scanning and assessing any other IP in the Entry Point's network
Physical attacks against VulnLawyers properties
Unverified scanner output
Man-in-the-Middle attacks
Any vulnerabilities identified through DDoS or spam attacks
Self-XSS
Login/logout CSRF
Issues with SSL certificates, open ports, TLS versions, or missing HTTP response headers
Vulnerabilities in third party libraries unless they can be leveraged to significantly impact the target
Any theoretical attacks or attacks that require significant user interaction or low risk
Approach
Mathias Detmers performed testing under a "Black Box" approach from July 26, 2025, to July 27, 2025 without credentials or any advance knowledge of VulnLawyer’s web applications with the goal of identifying unknown weaknesses. Testing was performed from a non-evasive standpoint with the goal of uncovering as many misconfigurations and vulnerabilities as possible. Testing was performed remotely. Each weakness identified was documented and manually investigated to determine exploitation possibilities and escalation potential. Mathias Detmers sought to demonstrate the full impact of every vulnerability, up to and including internal network access.
Scope
The scope of this assessment was as follows *.topaz.ctfio.com and any and all open web server ports discovered on the target IP address provided at the start of the assessment.
Assessment Overview and Recommendations
This assessment provides an overview of critical security vulnerabilities identified during the evaluation of VulnLawyers's externally facing web applications. The findings highlight issues related to access control, credential management, and data exposure. Each vulnerability has been categorized based on severity and associated CWE identifiers to assist with prioritization and remediation. The following sections detail the key findings, their potential impact, and actionable recommendations to enhance the application's security posture.
Key Findings
1. Authentication Portal Discovery via Source Code Disclosure
Internal-only login functionality was unintentionally disclosed in
/login, pointing to/lawyers-only-login.Severity: Low | CWE-200
2. Exposed Subdomain Hosting Unauthenticated User Directory
Subdomain
data.topaz.ctfio.comexposed a/usersendpoint listing full names and email addresses without authentication.This directly enabled targeted brute-force attacks against valid accounts.
Severity: Medium | CWE-200
3. Weak Credentials Allow Unauthorized Access
The account
jaskaran.lowe@vulnlawyers.ctfwas compromised.Demonstrates lack of complexity enforcement and absence of rate limiting.
Severity: High | CWE-521
4. Insecure Direct Object Reference (IDOR) Leads to Credential Leakage
Authenticated users could incrementally enumerate other users' profiles via
/lawyers-only-profile-details/{id}.Exposed plaintext passwords, full names, and emails of all users.
Severity: Critical | CWE-639
5. Privilege Escalation and Destructive Actions
One of the compromised accounts (
shayne.cairns@vulnlawyers.ctf) had elevated privileges.After logging in with credentials exposed via IDOR, it would have been possible to delete case records.
Severity: Critical | CWE-639
Risk Summary
The vulnerabilities allow an unauthenticated attacker to:
Discover sensitive endpoints and internal API logic,
Enumerate all user accounts and their credentials,
Access the application as multiple users — including privileged users,
Carry out destructive operations such as case deletions.
These issues indicate a lack of access control, improper credential storage, and insufficient input validation across the application stack. If exploited, these weaknesses could lead to reputational damage, legal liability, and breach of client confidentiality.
Recommendations
Enforce Strong Authentication Policies
Mandate complex passwords and implement account lockout or CAPTCHA after failed login attempts.
Introduce two-factor authentication (2FA) for privileged accounts.
Remediate IDOR Vulnerabilities
Implement access controls that verify ownership or permissions on all sensitive object references.
Remove plaintext passwords from any API responses.
Restrict Access to Internal Endpoints
Obfuscation is not security. Restrict access to endpoints like
/lawyers-only-login.
Web Application Assessment Summary
Summary of Findings
1
CRITICAL
Privilege Escalation via IDOR Leads to Full Account Compromise and Case Deletion - CRITICAL
2
CRITICAL
Insecure Direct Object Reference (IDOR) Exposes User Profiles and Passwords - CRITICAL
3
HIGH
Valid Account Compromised via Weak Password on Sensitive Login Portal - HIGH
4
MEDIUM
Exposed User Enumeration API Endpoint on Subdomain - MEDIUM
5
LOW
Unintended Disclosure of Restricted Resource Location via Source Code - LOW
Technical Findings Details
The technical findings listed below are not arranged in order of criticality, but according to their interdependence. The severity level is not determined solely by the CVSS score, but also by the impact and business criticality.
Unintended Disclosure of Restricted Resource Location via Source Code - LOW
CWE
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVSS 3.1
5.3 (Medium) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Root Cause
During testing, it was observed that the /login endpoint of the target application redirected users to a denial page (/denied) with the message:
"Access is denied from your IP Address."
However, requesting this page via curl revealed hidden content in the HTML source indicating that the login portal had moved and could be found at /lawyers-only. Following this path redirects to /lawyers-only-login, which appears to be the actual login page.
Impact
While the protected resource itself may remain secure, leaking its location can:
Aid an attacker’s reconnaissance efforts.
Enable brute force or targeted attacks on the new login page.
Affected Component
https://topaz.ctfio.com/login
Remediation
Avoid disclosing sensitive internal paths or resource locations in publicly accessible source code or comments.
Implement proper access controls for internal endpoints, and return generic error messages for unauthorized access.
Finding Evidence - Unintended Disclosure of Restricted Resource Location via Source Code
A request to https://topaz.ctfio.com/login redirects to https://topaz.ctfio.com/denied. A log in with our IP seems to be prohibited. But https://topaz.ctfio.com/login can be accessed using cURL.
By requesting https://topaz.ctfio.com/login via cURL, we are able to bypass the redirect and find a reference to /lawyers-only.
These and other hidden pages like /lawyers-only-login can also be enumerated using FeroxBuster.
The page /lawyers-only-login can be accessed without any restrictions.
Exposed User Enumeration API Endpoint on Subdomain - MEDIUM
CWE
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVSS 3.1
5.3 (Medium) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Root Cause
During testing, a virtual host enumeration was executed on the target domain topaz.ctfio.com. The subdomain data.topaz.ctfio.com was discovered using ffuf. This host revealed a potentially sensitive API endpoint:
https://data.topaz.ctfio.com/users
This endpoint is publicly accessible and exposes a list of user data, including full names and email addresses. No authentication or API token was required to access this information.
Impact
Violates the principle of least privilege.
Increases the likelihood of targeted attacks.
Affected Component
https://data.topaz.ctfio.com/users
Remediation
Protect the api vhost and sensitive endpoints like
/userswith proper authentication and authorization.Avoid exposing full user directories or email lists via public-facing APIs.
Finding Evidence - Exposed User Enumeration API Endpoint on Subdomain
We enumerate the subdomains via FFuF and find the VHOST data.
The access on https://data.topaz.ctfio.com is not restricted and gives access to the VulnLawyers Website API.
API endpoints can be enumerated. The endpoint https://data.topaz.ctfio.com/users could be identified.
The API endpoint https://data.topaz.ctfio.com/users provides access to user data, including their email addresses.
The following users are affected:
Valid Account Compromised via Weak Password on Sensitive Login Portal - HIGH
CWE
CWE-521: Weak Password Requirements
CVSS 3.1
8.2 (High) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Root Cause
During testing the login portal at /lawyers-only-login was previously discovered through hidden references in source code. Password spraying was then conducted against this login endpoint using known email addresses gathered from the exposed /users API on data.topaz.ctfio.com.
The account jaskaran.lowe@vulnlawyers.ctf was found to be using a simple, guessable password, allowing full access to the portal.
Impact
Unauthorized access to internal or potentially sensitive legal data.
Affected Component
https://topaz.ctfio.com/lawyers-only-login
Remediation
Enforce strong password complexity requirements (e.g., minimum length, uppercase/lowercase, symbols, etc.).
Implement rate-limiting and account lockouts on authentication endpoints to prevent brute-force attacks.
Consider multi-factor authentication (MFA), especially for sensitive roles or portals.
Review user password policies and educate staff about secure credential practices.
Finding Evidence - Valid Account Compromised via Weak Password on Sensitive Login Portal
A password spray with all emails found from https://data.topaz.ctfio.com/users was performed on https://topaz.ctfio.com/lawyers-only-login using FFuF. Valid credentials could be identified for jaskaran.lowe@vulnlawyers.ctf.
With those credentials we are able to acces /lawyers-only. Furthermore, after logging in, it can be determined that the user Shyne Cairns is a case manager for a case.
Insecure Direct Object Reference (IDOR) Exposes User Profiles and Passwords - CRITICAL
CWE
CWE-639: Authorization Bypass Through User-Controlled Key
CVSS 3.1
8.1 (High) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Root Cause
After authenticating as a valid user (jaskaran.lowe@vulnlawyers.ctf), access to the endpoint /lawyers-only-profile reveals a link to a more detailed user-specific page:
/lawyers-only-profile-details/4
This URL pattern indicates the use of numeric user IDs. Testing adjacent IDs manually (e.g., /3, /2, etc.) reveals a lack of authorization checks. Any authenticated user can enumerate and view the full profile of other users, including:
Full name
Email address
Password (plaintext)
Impact
Unauthorized access to sensitive user data across accounts.
Unauthorized access to internal or potentially sensitive legal data.
Exposure of user passwords increases the risk of:
Credential reuse attacks on other systems.
Internal account compromise or privilege escalation.
Legal and regulatory risk if credentials are leaked.
Affected Component
https://topaz.ctfio.com/lawyers-only-profile-details/{id}
Remediation
Implement authorization checks on all sensitive endpoints to ensure users can only access their own resources.
Never expose passwords in responses, even to the account owner.
Finding Evidence - Insecure Direct Object Reference (IDOR) Exposes User Profiles and Passwords
After we have logged in, we intercept the request made when clicking on Profile using Burp Suite.
We see a request made to /lawyers-only-profile-detail/4.
We are able to request information about our own account, including the password
By specifying other user IDs, we can also retrieve details and passwords of other users.
Privilege Escalation via IDOR Leads to Full Account Compromise and Case Deletion - CRITICAL
CWE
CWE-639: Authorization Bypass Through User-Controlled Key
CVSS 3.1
8.8 (High) CVSS/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Root Cause
Through exploitation of an Insecure Direct Object Reference (IDOR) vulnerability on the endpoint:
https://topaz.ctfio.com/lawyers-only-profile-details/{id}
it was possible to retrieve the full profile data including plaintext password of a privileged user by changing the numeric ID parameter.
From there we were able to:
Log in as the privileged user using the leaked credentials.
Access functionality not available to normal users, such as deleting case records.
Impact
Compromise of privileged accounts.
Unauthorized modification and deletion of legal data.
Unauthorized access to internal or potentially sensitive legal data.
Affected Component
https://topaz.ctfio.com/lawyers-only-profile-details/{id}
Remediation
Implement authorization checks on all sensitive endpoints to ensure users can only access their own resources.
Never expose passwords in responses, even to the account owner.
Finding Evidence - Privilege Escalation via IDOR Leads to Full Account Compromise and Case Deletion
User ID 2 /lawyers-only-profile-details/2 reveals the credentials of Shayne Cairns. This user is a case manager.
After logging in with the credentials we found, we are able to delete the case.
Last updated