Secure Legion Labs
Labs/IDOR/Extreme

IDOR Progression

IDOR - Extreme

This room simulates a forensic snapshot portal with layered identifiers: tenant, case file, and snapshot token. The system verifies tenant access and case existence, but it trusts snapshot tokens globally and never checks whether the snapshot actually belongs to the authorized case.

ObjectivePivot into a foreign forensic snapshotCombine a valid tenant and case with the wrong snapshot token to leak privileged data.
DifficultyExtremeThree identifiers, decoys, and a deeper object relationship bug.
FlagUnlock on target snapshot leakThe flag appears only when the final privileged snapshot is exposed.
Request Model

What the portal expects

The current responder has access to tenant legion-blue and case CASE-4721. Snapshot tokens look random, but the service trusts them independently once the case gate passes.

  • Tenant?tenant=legion-blue
  • Case&caseId=CASE-4721
  • Snapshot&snapshot=SNAP-1A7
Hint: Deep authorization bugs often appear when outer checks succeed, but the final object is still looked up in a broader scope than intended.
Access Logic

What the application gets wrong

The platform validates the tenant and checks that the user can see the requested case. The flaw is that the snapshot lookup happens afterward with no verification that the snapshot belongs to that case inside that tenant.

if (tenantAllowed && caseAllowed(caseId)) {
  snapshot = snapshots[token]
  return snapshot
}
// missing snapshot.caseId === caseId and snapshot.tenant === tenant
Snapshot Console

Load a forensic snapshot

Work inside the tenant and case you are allowed to access, then test snapshot tokens to see what leaks through.

Current request: GET /api/snapshot?tenant=&caseId=&snapshot=
{ "status": "idle" }
Snapshot preview
Snapshot Viewer

Rendered output

The portal trusts the snapshot token after the outer authorization checks pass. That deeper trust boundary is the vulnerability.

No snapshot loaded.

Status: waiting for a snapshot request.

Flag Unlock

Challenge flag

The flag appears only after you reach the intended foreign snapshot while staying inside an authorized tenant and case context.

Flag:
Submit Flag

Validate completion

Submit the unlocked flag to finish the extreme room.

Flag is locked until you reach the intended foreign snapshot.

Execution Path

How the IDOR happens here

1. Pass outer checks

The tenant and case gates succeed for the current user.

2. Trust global token

The snapshot token is looked up globally instead of within the authorized case.

3. Leak privileged evidence

A foreign snapshot is returned because the deepest object relationship was never enforced.