Chaining Broken Access Control Bugs to Account Takeover

Summary

The speaker demonstrates in a lab how IDORs and exposed authentication tokens can be chained into account takeover, and advises mapping authorization boundaries while considering bug bounty program scope.

Key points

• The speaker says they earned over $30,000 from a broken access control bug bounty finding, and uses a lab to demonstrate the techniques.
• Changing record IDs in the lab exposes another user's data; altering or removing a clinic ID can reveal users' data across clinics.
• A team-profile flaw exposes sensitive material, including an authentication token and MFA secret, according to the demonstration.
• The speaker uses a leaked token with an impersonation function to access another user's account, illustrating how separate flaws can combine into account takeover.
• For multi-tenant applications, the speaker recommends tracing how organization, user, and other identifiers connect to data access.
• The speaker advises checking newly accessible endpoints after privilege escalation, while warning that deeper testing may be outside a program's scope and urging judgment.