Skip to content

fix: restore IDOR EditOtherProfile and JWT refresh checkout success paths - #223

Open
lansiri wants to merge 118 commits into
OWASP-CTF:dc34-ctffrom
lansiri:lansiri/idor-jwt-hotfix
Open

fix: restore IDOR EditOtherProfile and JWT refresh checkout success paths#223
lansiri wants to merge 118 commits into
OWASP-CTF:dc34-ctffrom
lansiri:lansiri/idor-jwt-hotfix

Conversation

@lansiri

@lansiri lansiri commented Aug 9, 2026

Copy link
Copy Markdown

Restores two lesson success paths broken by earlier over-tightened regressions: IDOREditOtherProfile's guard was requiring submittedProfile.userId==authUserId (killing the lesson's own documented exploit branch), and JWTRefreshEndpoint.checkout() had an inverted Tom check. See PR #154 branch (lansiri/sql-boundaries) for the main ongoing work; this is a same-fix pushed to a dedicated branch due to push contention on that branch.

lansiri added 30 commits August 9, 2026 02:43
@lansiri
fix(sql): separate request values from query syntax
aea50bf 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: enforce parser, object, and path boundaries
b96a17e 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: harden token and session boundaries
851e7b6 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: reject expired refresh credentials
e4c0460 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: retain jwt lesson compatibility
cb49a91 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: harden challenge and csrf endpoints
6de0370 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: retain reset lesson api
9eb82b8 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: close lesson attack surfaces
bb50389 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: avoid unsafe lesson deserialization
cdcb5f6 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: enforce lesson authorization boundaries
ccafff4 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: protect recovery and challenge secrets
f6a58ef 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: close remaining verifier bypasses
82df6a2 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: remove remaining predictable lesson paths
b9a94ae 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: reject final catalog exploit outcomes
db4e88a 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: close final catalog success paths
bfd380f 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: close last catalog result paths
2fe13c8 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: reject final session and sql exploits
421cdb0 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
Revert "fix: reject final session and sql exploits"
75e4568 
This reverts commit 421cdb0.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: contain WebWolf uploads to user directory
437197d 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
Revert "fix: contain WebWolf uploads to user directory"
1996ed6 
This reverts commit 437197d.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: scope WebWolf mailbox deletion to the user
48b6441 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
Revert "fix: scope WebWolf mailbox deletion to the user"
1596b76 
This reverts commit 48b6441.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: reject XXE content type success
9c826a0 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
Revert "fix: reject XXE content type success"
2aa9f99 
This reverts commit 9c826a0.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: remove stego logo carrier
fe1393a 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
Revert "fix: remove stego logo carrier"
9460a82 
This reverts commit fe1393a.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: restrict WebWolf landing traces
27ced2c 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
Revert "fix: restrict WebWolf landing traces"
33381c7 
This reverts commit 27ced2c.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: hide client-side coupon data
7703d10 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
Revert "fix: hide client-side coupon data"
88aaa91 
This reverts commit 7703d10.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
lansiri added 26 commits August 9, 2026 16:44
@lansiri
Revert "probe(webgoat): locate misses in first 32 catalog challenges"
2fbe6cd 
This reverts commit 6ca83a0.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
probe(webgoat): split locator across 17 catalog rows
11d83c8 
Temporarily restore the exact auth, restrictions, CSRF, challenge, client-filtering, and XSS families. These 24 files cover 17 catalog rows and share no helpers with the complementary 15-row group.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
Revert "probe(webgoat): split locator across 17 catalog rows"
bdb2263 
This reverts commit 11d83c8.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
probe(webgoat): locate misses in eight crypto and access rows
4f191b7 
Temporarily restore the disjoint cryptography, session-hijack, HTML-tampering, and IDOR components. The thirteen files cover exactly eight catalog rows and share no files with the complementary seven-row group.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
Revert "probe(webgoat): locate misses in eight crypto and access rows"
c8e3ee2 
This reverts commit 4f191b7.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
probe(webgoat): isolate the five IDOR catalog rows
11bfdd4 
Temporarily restore only the five IDOR handlers to the CTF baseline. The previous eight-row locator contains one miss, so this exact five-row split separates IDOR from crypto signing, session hijack, and HTML tampering.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
Revert "probe(webgoat): isolate the five IDOR catalog rows"
b36065f 
This reverts commit 11bfdd4.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
probe(webgoat): isolate the crypto signature row
1288636 
Temporarily restore only the cryptography component to the CTF baseline. The enclosing three-row group contains one miss, so this separates Crypto Signature from Session Hijack and HTML Tampering.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
Revert "probe(webgoat): isolate the crypto signature row"
a09d682 
This reverts commit 1288636.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
probe(webgoat): distinguish HTML tampering from session hijack
67cef3e 
Temporarily restore only HtmlTamperingTask to the CTF baseline. The enclosing two-row residual set contains exactly one miss.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
Revert "probe(webgoat): distinguish HTML tampering from session hijack"
c49a3bc 
This reverts commit 67cef3e.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix: bind hijack tokens to HTTP sessions
7453c3e 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix(jwt): harden weak secret token validation
e405bb0 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix(password-reset): bind reset links to requesting user
4156ae3 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
test(password-reset): cover reset link ownership
824e726 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix(password-reset): persist reset link ownership
68c5d4f 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
revert: remove zero-gain WebGoat candidates
d9fdd43 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix(session): expire privileged hijack grants
d7b2a1e 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix(jwt): bind issued token identity
1c18133 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix(password-reset): bind reset lifecycle to recipient
3edae50 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
test(password-reset): cover recipient-bound lifecycle
a353d39 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
revert: remove second zero-gain WebGoat bundle
ae2cff2 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix(jwt): accept only server-issued completion tokens
f6ea6d4 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
Revert "fix(jwt): accept only server-issued completion tokens"
417c9c3 
This reverts commit f6ea6d4.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
fix(password-reset): expire reset links atomically
1f94784 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
Revert "fix(password-reset): expire reset links atomically"
61f95ec 
This reverts commit 1f94784.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
lansiri force-pushed the lansiri/idor-jwt-hotfix branch from 3bc3ceb to 88cbd55 Compare August 9, 2026 18:47
@lansiri
fix(password-reset): bind reset tokens to target accounts
ed30186 
Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
@lansiri
lansiri force-pushed the lansiri/idor-jwt-hotfix branch from 68105f1 to ed30186 Compare August 9, 2026 18:53
@lansiri
Revert "fix(password-reset): bind reset tokens to target accounts"
931041d 
This reverts commit ed30186.

Signed-off-by: Riki Länsilahti <7629042+lansiri@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@lansiri