The Staff Room

The staff back office at /admin is properly locked: log in as a normal customer and you get bounced. But the developers protected the page they were thinking about and forgot the one next to it. An admin export endpoint sits wide open, and it hands the whole customer list to anyone who asks.

1 · Find it

Try to reach the back office without logging in and you are turned away:

GET /admin      -> 302, redirected to /login

So the obvious door is locked. Now go looking for others. Admin areas rarely have just one endpoint, and a back office almost always has an export. Just guess it: type this straight into your browser’s address bar:

http://localhost:3000/admin/export

It answers 200 OK, with no login. That is the whole flaw, found with nothing but a hunch and the address bar.

Hard mode · let a tool find it. Instead of guessing, point a directory brute-forcer at the site with a wordlist and it will turn up unlinked paths like /admin/export for you:

ffuf -u http://localhost:3000/FUZZ -w wordlist.txt

2 · Exploit it

That endpoint answers with no login at all. It returns the full customer list, emails and admin flags included:

{
  "generated_at": "...",
  "customers": [
    { "id": 1, "email": "ada@example.com",   "is_admin": 0, "credit_pence": 0 },
    { "id": 6, "email": "owner@example.com",  "is_admin": 1, "credit_pence": 0 },
    ...
  ]
}

You now have every customer’s email and, helpfully, which of them is an administrator, without ever proving you are staff.

3 · Understand it

The two handlers sit side by side. One asks for an admin session; the other never got the memo:

// locked
app.get('/admin', requireAdmin, (req, res) => { ... });

// wide open
app.get('/admin/export', (req, res) => {
  res.json({ customers: allCustomers() });
});

Nothing marks the export as sensitive. Access control that lives on individual routes is only as good as the developer’s memory.

4 · Fix it

Put the same guard on the export, and prefer a model where admin areas are protected by default rather than one route at a time:

app.get('/admin/export',
  (req, res) => { ... });

// guard the whole prefix
app.use('/admin', requireAdmin);
app.get('/admin/export',
  (req, res) => { ... });

Now every path under /admin, present and future, needs a staff session before it does anything.