Webverselabs HeadCount Challenge IDOR
Scenario :
Headcount’s engineering team added an include_raw parameter to the aggregation endpoint for debugging during the compensation review sprint. A TODO comment in the org chart template reminded them to remove it. Neither the comment nor the parameter made it into the cleanup ticket. A regular employee account is enough to pull full compensation report data.
Solution :
We first start by creating our account so that we can navigate the app.
Once inside, we can start enumerating each endpoint, the goal here is to check all endpoints then move to Burp’s History to see if we have any requests parameters that we can tamper with , an ID or somethine like that.
/Briefing :
Just a static page with a memo we can read, nothing that useful really .
One thing to note is that once we login , we see 2 Requests made to the server :
/api/me and /api/orgchart :
The /api/me returns information about us : ID, email, Role, etc .
And /api/orgchart returns information about the entire organization :
For now let’s keep enumerating the app.
/Directory :
When we visit it , we get the same GET request as before, the /api/orgchart .
/Comp bands :
A static web page , nothing useful , Request doesn’t contain any parameters.
/Profile :
We find a list of Resources we can access , we already checked /api/me and /api/orgchart , what’s left is the /api/hr/reports/aggregate :
If we try accessing it, we get a forbidden error, Only HR Admins are allowed.
After checking all the endpoints i didn’t find any useful information we can use so i decided to read front end code for each endpoint , then i found this comment on the /orgchart endpoint :
We see this include raw parameter that they want to remove before prod , maybe we can use this to get more information about an endpoint , specifically the one we can’t access like the /api/hr/reports/aggregate endpoint :
Before that i did add it to all the other requests to see if it would give us additional information :
For the value, it just made sense that it will either True or false (1 or 0 ) or something like that, but just a Boolean.
If we add it, we see that it bypasses the Restriction we had earlier . We can list the content of the page .
Now if we scroll down , we should be able to see our Flag :
That was all for this challenge, see you in the next one :)