Referer-based access control
This lab controls access to certain admin functionality based on the Referer header. You can familiarise yourself with the admin panel by logging in using the credentials
Reproduction and proof of concept
Log in using the admin credentials
Browse to the admin panel, promote
carlos, and send the HTTP request to Burp Repeater.
Open a private/incognito browser window, and log in with the non-admin credentials.
/admin-roles?username=carlos&action=upgradeand observe that the request is treated as unauthorised due to the absent Referer header.
Copy the non-admin user’s session cookie into the existing Burp Repeater request, change the username to yours, and replay it.
An attacker will need to log in using the credentials
wiener:peter and exploit the flawed access controls to become an administrator.