Webverselabs Overrun Challenge IDOR

Scenario :

Overrun’s contract change-order module shipped two sprints ago. The endpoint that opens a single change order is mounted under a project route — and the middleware on that route only checks that the calling PM owns the project. The handler then loads the change order by its global record id without re-checking that the change order actually belongs to that project. The bug has been live for weeks. The internal notes on a confidential change order at Harbour Point are about to be read by the wrong people.

Solution :

We first start by creating an account . Then browse the application just like a normal user, check all endpoints , features , etc. Then we check Burp’s History to get details about the requests sent to the server .

We’re mainly looking for parameters we can tamper with or inject in , wether it’s a GET or POST Request .

/Dashboard :

The dashboard gives general information about our porftolia , like the Budget; Variance, Let’s check other endpoints .

/Site Log :

This allows us to view projects and sort them based on Projects, date,etc. But nothing really useful for us here .

/Reports :

This endpoint allows us to generate reports, as well as view the old ones . Tried submiting a report but looking at the Burp Request, we can’t really do much with it.

/Audit Log :

This is a list of Reports for different projects , just a static web page , nowhere to go from here .

Now if we go back to the Dashboard endpoint, we can enumerate the features further :

Now first one : If we try Open Project :

I tried modifying the ID to see if we can access any other document .But that just redirects us back to the Dashboard .

Now let’s take a look at Change Order Botton :

First i tried doing is modifying the id in the URL to something else, maybe we can modify the order of other documents .

If we change it from 3 to 1 we get access denied .

Now i tried FUZZING for all numbers that won’t returns access denied . For this i used FFUF .

We see that all of them return a 302 , with Access denied .

Now back to our Change Order Endpoint :

We can try and open any of the projects below .

Nice a new ID we can modify :)

If we modify it we either get a change order not found or a different Report .

We can FUZZ again and filter the response for ‘Change order not found.’

ffuf -u https://a36dfc57-4327-overrun-1286f.challenges.webverselabs-pro.com/projects/3/change-orders/FUZZ -w Numbers -H "Cookie: rack.session=Kofy%2FFXbcr2fbz%2F6ZtuIDgzBLYZ3uHEKDQbnfGUC0%2BGduabjqFDtM1ULvK8GOWtQnbDTNucAblsIt0rZapfm6GCT%2BBIZRHYUzEXNjoguXve7VRzuFKT4LdwNOOBewuy62W%2FEuAM3vA9H65Nr%2Bx7kMVV5qsLY4l%2ByLiEipr9Pna%2BRunKWxHmdIVLIeqXXuRnDhFA6vMYlJHD8guHzjH%2BNEnSuj6si%2BxDf8Jc9V9KRneDegyhRyQqgHVV%2FiGVwfE9C41SghqRJM9Ku3QpBjlNa02I19ULg4R1p8DmGoeO5BvhgbNxplIFnlgIIWzPNb6gbONFUI6Kt86odxorAyPqp0ZHnTIFyGbKHEt2wFmzAN%2BH443aMXExGA2f0gVav9hmPNgou7bflbvDv9qIlv966UeSN84yFuHoFuIZr0juocrJVbeCBbFie8AqQ1%2FpDrN7TtwId8Rqx4DAYjtlvxQc4z3q1OBfEMka6UgHlbqeTpsQdwRYGPYPKA3i0mg%3D%3D--TARajkSX5Atsk7fv--atUal1F3w00xLBVjRSdSog%3D%3D"  -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"  -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7" -fc 302

Make sure you add the Cookie,User agent, accept,etc.

We see that 4 returns more Word than the rest, hopefully it’s the flag :)

Perfect we got our flag .

That was all for this challenge. See you in the next one :)