Vulnerability Overview
The application suffered from two compounding vulnerabilities: an unauthenticated diagnostic endpoint /sessions that exposed all live session tokens in plain text, and non-expiring sessions configured with _permanent: True. Together, these allowed any authenticated user to hijack the admin account with no brute force required.
Reconnaissance
After registering a normal account and exploring the application, a comment left by another user on the homepage read: "Hey I found a strange page at /sessions". This was information disclosure through the application's own content — appending /sessions to the base URL confirmed the endpoint existed and required no additional authentication to access.
Identifying the Vulnerability
The /sessions page returned all active session tokens in plain text, including their associated user roles:
session: NAcR0zstNIRnUNc51NekMeb1CsBdZW6w8AH7ojlah4E — {'_permanent': True, 'key': 'admin'}
session: VjEQF4wGe-yXPvfnIqoBYOUrcj2vKShTdCZZP6TufnQ — {'_permanent': True, 'key': '123'}The admin session was clearly marked and, critically, set to never expire — meaning it had been valid since the account was created.
Exploitation
Using a browser Cookie Editor extension, the current session cookie was replaced with the admin's token. A page refresh was sufficient to authenticate as admin — no password, no brute force. The flag was displayed on the homepage post-login.
Root Cause
Two independent failures combined into a critical exploit chain. First, the /sessions endpoint had no role-based access control — any authenticated user could enumerate all active sessions. Second, _permanent: True on the session configuration meant tokens never rotated or expired, giving the leak an indefinite window of opportunity.
| Control | Implementation |
|---|---|
| Session expiration | Set PERMANENT_SESSION_LIFETIME to 15–30 minutes; rotate tokens on privilege escalation |
| Endpoint access control | Restrict /sessions to admin role only, or remove it entirely from production |
| Token confidentiality | Session tokens must never be readable by other authenticated users under any circumstances |