Improper Authentication Allows Making Requests as Other Users

How it was found

This vulnerability allows unauthenticated users to submit different types of requests as another user by manipulating HTTP responses. By changing server responses from a redirect (302) to a successful response (200), attackers can bypass the application's authentication requirements and perform actions reserved for logged-in users. This can lead to unauthorized submissions,

With this requirement in mind, I captured a request to the following URLs:

GET /App/createrequest.aspx

I then forwarded the request and intercepted the server's response. After intercepting the response, I changed the 302 to a 200 response and forwarded the modified request to my browser. From this point, I filled in the required fields, intercepting and modifying the response for several of the dropdown selections as well in order to proceed. For the email field, I was able to input the email address of another application user.

Note: An unauthenticated user can validate emails using the following URL: /████████ After supplying an email and filling in the required fields, I submitted the request. As a result, an email was sent to the victim's email address verifying successful submission.

Impact

Submit requests as other users of the application, impacting the integrity of the system and the confidentiality of information on its users.

System Host(s)

██████████

Affected Product(s) and Version(s)

PAL V:?

CVE Numbers

Steps to Reproduce

Please see the attached video on reproducing the bug.

Suggested Mitigation/Remediation Actions

To remediate this vulnerability, the application should enforce strict authentication checks on all requests to sensitive endpoints, ensuring that only authenticated users can access them. Additionally, responses should be validated on the server side to prevent unauthorized manipulation of HTTP status codes. Implementing these measures will ensure that only legitimate, authenticated users can perform actions like submitting requests.