Secure Legion Labs
Labs/IDOR/Hard

IDOR Progression

IDOR - Hard

This room simulates a document export portal where the user selects a workspace and a report reference. The application verifies membership in the workspace but trusts the report reference independently, which leaks files from other workspaces inside the same organization.

ObjectivePull a report from the wrong workspaceUse a valid workspace context with a foreign report reference.
DifficultyHardMembership checks exist, but the file-level relationship check is missing.
FlagUnlock on foreign report accessThe flag appears only when the target report leaks across workspaces.
Request Model

What the portal trusts

The current analyst has access to the apollo workspace. The report export feature trusts the report reference as long as the user stays inside a workspace they already belong to.

  • Workspace?workspace=apollo
  • Report&reportRef=RPT-A11
  • GoalExpose a foreign export
Hint: Access to a parent container does not automatically prove access to every nested object referenced inside the same request.
Access Logic

What the application gets wrong

The application validates workspace access but stops too early. It forgets to ensure the report being requested belongs to the same workspace that was authorized.

if (memberOf(workspace)) {
  report = reports[reportRef]
  return report
}
// missing report.workspace === workspace
Request Console

Export a report

Stay inside the workspace you legitimately control, then experiment with report references.

Current request: GET /api/report?workspace=&reportRef=
{ "status": "idle" }
Report preview
Export Viewer

Rendered output

The export preview returns the report whenever the workspace is authorized and the reference exists. The missing check is the relationship between the authorized workspace and the actual report owner.

No report loaded.

Status: waiting for a report request.

Flag Unlock

Challenge flag

The flag appears after you pull the intended foreign report into the workspace you already control.

Flag:
Submit Flag

Validate completion

Submit the unlocked flag to finish the hard room.

Flag is locked until you reach the foreign target report.

Execution Path

How the IDOR happens here

1. Authorize workspace

The app confirms the user belongs to one workspace.

2. Trust report ref

It loads the report object independently from the workspace authorization.

3. Leak foreign export

A foreign report reference slips through because the app never binds it back to the authorized workspace.