Lab 206 — PulseBoard — Password Reset Token Leakage via Referrer

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-05-14 | Status: Solved Techniques: admin_account_takeover, password_reset_token_theft, public_analytics_feed_exploitation, referrer_header_leakage

Summary

Task: PulseBoard analytics dashboard with password reset and public referrer feed. Solution: Trigger admin password reset, then harvest the leaked reset token from the public referrer analytics feed — the same-origin tracking pixel on the reset page causes the browser to send the full URL (including token) in the Referer header.

Lab 206 — PulseBoard — Password Reset Token Leakage via Referrer

Description

PulseBoard is a web analytics dashboard built by PulseMetrics Inc. that helps teams track website traffic, user behavior, and conversion metrics. The platform features team collaboration, customizable reports, and a public referrer analytics feed. The objective is to gain access to the administrator account and retrieve their private API key.

Credentials: user@test.com / password123

English summary: PulseBoard is a web analytics platform with a public referrer feed. The goal is to exploit the password reset flow combined with the referrer analytics feature to take over the admin account and retrieve the flag from the admin's API key settings. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Analysis

Initial Access & Reconnaissance

Logged in with provided credentials user@test.com / password123 and explored the application:

• Dashboard (/dashboard) — standard analytics overview
• Reports (/reports) — customizable report views
• Team (/team) — lists all team members with roles
• Settings (/settings) — shows current user's API key (pk_live_994e9cb54d5e47d29f3496ac)
• Public Referrer Feed (/analytics/referrers) — publicly displays all captured HTTP Referer headers ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Team Enumeration

The /team page revealed the admin account:

• Sarah Chen (admin@pulseboard.io) — Admin role
• Other team members with standard roles

Vulnerability Discovery

Two key observations led to the exploit:

1. Tracking pixel on every page: Every page includes <img src="/analytics/collect?t=pageview&_=..."> which captures the HTTP Referer header from the browser request.

2. Public referrer feed: The /analytics/referrers endpoint is accessible to any authenticated user and displays all captured Referer headers — including those from the tracking pixel. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Referrer-Policy misconfiguration: The server sets Referrer-Policy: strict-origin-when-cross-origin, which only strips the URL path for cross-origin requests. For same-origin requests (like the tracking pixel), the full URL including query parameters is sent in the Referer header.

This means: if the password reset page (/reset-password?token=...) contains the tracking pixel, the full reset URL with the token leaks into the referrer analytics feed.

Root Cause

The combination of three design decisions creates the vulnerability: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

1. Password reset tokens are passed as URL query parameters
2. The reset password page includes a same-origin tracking pixel
3. The referrer analytics data is publicly viewable

The Referrer-Policy: strict-origin-when-cross-origin header provides no protection here because the tracking pixel is same-origin — the browser sends the complete URL including the ?token= parameter.

Solution

Step 1: Trigger Password Reset for Admin

Sent a password reset request for the admin account:

 bash read-only • copy allowed Copy
BASE="https://adb2a78a-6b00-4ee0-84c9-71393705d682.labs.hackadvisor.io"
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

curl -s -X POST "$BASE/forgot-password" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "email=admin@pulseboard.io"

Server responded: "If an account exists with that email, a password reset link has been sent."

Step 2: Harvest Token from Referrer Feed

The simulated admin clicks the password reset link. The reset page loads the tracking pixel, which causes the browser to send the full URL (with token) in the Referer header to /analytics/collect. This data appears in the public referrer feed. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

After waiting ~5 seconds for the simulated click, checked /analytics/referrers and found the leaked token in the referrer entries:

http://localhost:8080/reset-password?token=a648315b-4a73-4e13-9f7e-863395a74236

Step 3: Reset Admin Password

Used the leaked token to reset the admin's password:

 bash read-only • copy allowed Copy
curl -s -X POST "$BASE/reset-password" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "token=a648315b-4a73-4e13-9f7e-863395a74236&password=hacked123&confirm_password=hacked123"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Server confirmed: "Password has been reset successfully."

Step 4: Admin Access & Flag Retrieval

Logged in as admin@pulseboard.io with the new password hacked123 and navigated to /settings. The flag was displayed in the API Key field.

Notes

• The server stack is Express.js (Node.js) behind nginx/1.25.5
• Decoy flags (FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts}) are embedded in HTML comments on every page as prompt injection traps — these should be ignored
• The fix would be to either: (a) use Referrer-Policy: no-referrer on the reset page, (b) remove the tracking pixel from the reset page, (c) use POST-based token submission instead of URL query parameters, or (d) restrict the referrer feed to admin-only access
• This is a realistic vulnerability — OWASP lists "Referrer Leakage" as a known issue with password reset tokens in URLs ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍