Bypassing Access Control in a Program on Hackerone !!

Wakatime(public program on hackerone platform)

This blog is about a vulnerability that I found in a program on hackerone i.e. Wakatime.It is a platform for developers and has an active bug bounty program on hackerone.

I decided to write a blogpost on this bug because I think this test case I used in finding the vulnerability can help a lot of hunters.

So, first I started by creating two accounts on their platform using two different email id’s.On their platform they have this functionality of private Leaderboard where you can see your rankings as a developer.

So, basically being an owner you can have multiple members under your team as well.One thing that popped in my mind is that lets check for access control of member?Let’s try to find out whether a member can control the owner or not ?

Photo by Mathew Schwartz on Unsplash

When I created a private leaderboard named test1 in my account pig.wig45@gmail.com then in the next step I sent invitation to sahil9619299166@gmail.com ,I accepted the request to join as a member and finally I visited the members section of the leaderboard through my pig.wig45@gmail.com account (owner account).

pig.wig45@gmail.com — — → Owner

sahil9619299166@gmail.com — — →Member

Private Leaderboard before swapping

Using my Owner account privileges for Anonymous user(referring to email id pig.wig45…) I swapped the roles of both tikoo(referring to email id sahil9619….) and Anonymous but the important thing to mention here is that I made the changes in a new tab (as you can see in the image I have two test1 leaderboard tabs opened in browser).

Have a look at the below image:

Private leaderboard after swapping

Once I successfully did that, now :

pig.wig45@gmail.com — — → Member

sahil9619299166@gmail.com — — →Owner

Now, I was having two private leaderboard pages open in which one member was owner in the other page and vice versa.In the first image POC where Anonymous(pig.wig45@…) was owner I tried to change the name of User tikoo(sahil9619…) to “testing” I got a Forbidden Error because in the second POC image Anonymous was no longer having owner privileges(look at the second image).

Forbidden Error:

Forbidden error on trying to change name of new owner

But this was all a big hoax, :-) look what happened when I tried to change the name again after the forbidden message popped up :-

Name of owner changed

As you can clearly see that even though I got a forbidden error but still I was able to manipulate the name of the owner of a private leaderboard using member’s privileges.

If u have any doubts just ping me on twitter

(https://twitter.com/viperbluff)!!!

Till next time — -> Happy Hacking :-)