Finding ID: BAC-Portswigger-002

Title: Unprotected admin functionality with unpredictable URL

Risk (Severity): High

Rationale:

The application exposes an administrative interface that is accessible without authentication. Although the admin panel is located at a non-obvious (unpredictable) URL, the location is disclosed within client-side JavaScript on the home page. Any attacker who inspects the page source can discover the admin endpoint and access sensitive administrative functionality without authorization. This allows full compromise of the application, including deleting user accounts.

Affected asset / Location:

Unprotected admin panel endpoint disclosed via client-side JavaScript

Root cause:

• Missing authentication and authorization checks on administrative functionality
• Disclosure of sensitive endpoints in client-side JavaScript
• Reliance on security through obscurity instead of proper access control

Discovery date: 2025–12–30

Executive Summary :

The application contains an unprotected admin panel located at an unpredictable URL. However, this URL is disclosed in the JavaScript code of the home page. An attacker can easily identify the admin endpoint by inspecting the page source and directly access the admin panel without authentication. This results in a Broken Access Control vulnerability that allows attackers to perform privileged actions such as deleting users, leading to complete application takeover.

Reproducible Steps (PoC — Lab Only) :

1. First, open the target lab in a browser, read lab description carefully.

2. Next, access the lab …

3. Try to append /robots.txt to the lab URL:

4. On the lab home page, right click and view the page source:

5. Identify a script that reveals the admin panel URL, for example:

5. I found a disclosed admin path

/admin-xyz123

6. Copy the disclosed admin path and append it to the lab base URL:

https://LAB-ID.web-security-academy.net/admin-xyz123

7. Load the URL and confirm that the admin panel is accessible without authentication and locate the list of users in the admin interface.

8. Click Delete next to the user carlos.

9. The user is successfully deleted, and the lab is solved.

Impact :

• Unauthorized access to administrative functionality
• Ability to delete or modify user accounts
• Full compromise of application security
• Clear exploitation of Broken Access Control (OWASP A01)

Remediation (Recommended) :

1. Enforce Authentication
   Require login before accessing any admin endpoints.
2. Implement Authorization Checks
   Ensure only privileged users can perform administrative actions.

3. Avoid Security Through Obscurity
Unpredictable URLs must not be used as a security control.

4. Do Not Expose Sensitive Endpoints in Client-Side Code
Never disclose admin paths in JavaScript, HTML, or comments.

5. Do Not Rely on robots.txt
robots.txt must never be used to protect sensitive paths.

6. Apply Role-Based Access Control (RBAC)
Validate permissions on every sensitive request.

7. Regular Security Testing
Include access control testing in security assessments.

References :

• OWASP Top 10 — A01: Broken Access Control
  https://owasp.org/Top10/A01_2021-Broken_Access_Control/
• PortSwigger — Access Control Vulnerabilities
  https://portswigger.net/web-security/access-control