Usable Links

Full solution below. Spoilers ahead.

Task description

Mario built a site for sharing links with friends. When someone sends him a link, he logs in as admin and visits it to check it, which can take a few seconds because he likes to look around. He opened the site to the public and gave you the source code of the page that checks links.

The original was in Croatian; this is my translation.

Two facts that combine

Two things in the task matter together. First, the admin opens every link you send, inside his own logged-in admin session. Second, we have the source of user.php.

Reading user.php, if the person visiting it is an admin, it reads a korisnik (“user”) parameter from the address and promotes that user to admin in the database. So a plain visit to one URL changes someone’s role, and only the admin’s visit counts.

Making the admin do it

We can’t become admin ourselves by visiting that page, because we aren’t one. But the admin visits any link we send. So we let his browser do it for us. This is cross-site request forgery, or CSRF: getting a victim’s browser to make a request that acts with their permissions.

We registered an account (we called ours hackniteWriteup) and sent the admin this link:

user.php?korisnik=hackniteWriteup

When the admin opened it to “check” it, his admin session ran the promotion and set our account’s role to admin. We logged out and back in, and as an admin we could see the flag.

The fix is that a link visit should never change anything. Actions like promoting a user must be deliberate submissions protected by a token the attacker can’t guess, so an admin simply opening a link can’t be turned into a command.