Vertical Privilege Escalation: Role Bypass and Unauthorized Administrative Function Access

web_auth_sessions Difficulty 1–5 30 min certifiable

Theory

Why This Matters

Vertical privilege escalation — a regular user gaining admin-level access — is the highest-severity class of access-control failure and is consistently present in real-world penetration test findings. In 2020, a researcher found that a Fortune 500 company's internal portal granted administrative API access to any authenticated employee simply by navigating to /admin/panel in a browser — the route existed, the UI link was hidden from non-admins, but no server-side role check was in place. The 2019 Citrix ADC vulnerability (CVE-2019-19781) allowed unauthenticated users to traverse to restricted management paths due to missing path authorization in the VPN portal. OWASP Broken Access Control (A01:2021) cites forced browsing, missing function-level access control, and privilege escalation via parameter injection as its primary sub-categories — all directly addressed in this card.

Core Concept

Vertical privilege escalation occurs when a lower-privileged user gains access to functionality or data reserved for higher-privileged roles (e.g., user → admin, read-only → read-write, free tier → enterprise). Unlike horizontal escalation (same role, different user's data), vertical escalation crosses role boundaries.

The primary mechanism is missing role-check middleware: the application routes requests to admin handlers without first verifying that the requesting session holds the required role. This arises in several patterns. A developer adds a new admin endpoint and forgets to apply the existing requireAdmin middleware. Authorization is enforced only at the UI layer (the button is hidden from non-admins) but not server-side. The admin endpoint exists as an internal API expected to be called only by the admin UI, and the developer assumes no external caller will discover it.

Forced browsing is the simplest exploitation technique: directly navigate to a known or guessed admin path using a low-privilege session. Tools such as feroxbuster and gobuster discover these paths, and Burp Autorize automates replay of all discovered requests with a low-privilege token.

Privilege escalation via parameter injection adds admin=true, is_admin=1, or role=admin to requests that are processed server-side without validation — a mass assignment variant specifically targeting role elevation.

Function-level access control differs from URL-based ACL: a URL-based ACL blocks /admin/* at the route level, but function-level checks validate the user's role inside each handler function. URL-based ACLs are bypassable via path normalization (/admin/../admin/users, /Admin/users on case-insensitive file systems), HTTP method confusion, and symlink traversal.

Technical Deep-Dive

-- Forced browsing: low-privilege user directly requests admin endpoint
GET /admin/users HTTP/1.1
Host: victim.com
Cookie: session=<standard_user_session>

HTTP/1.1 200 OK          <-- Should be 403 Forbidden
[{"id":1,"username":"admin","role":"superadmin","email":"[email protected]"},
 {"id":2,"username":"alice","role":"user","email":"[email protected]"}]

-- Parameter injection: add admin flag to a profile update
POST /api/profile/update HTTP/1.1
Host: victim.com
Content-Type: application/json
Cookie: session=<standard_user_session>

{"display_name":"hacker","admin":true,"role":"admin"}

HTTP/1.1 200 OK
{"display_name":"hacker","role":"admin"}
-- Server accepted and persisted the injected role value

# Path normalization bypass test
import requests

session = "<low_priv_session>"
admin_paths = [
    "/admin/users",
    "/Admin/users",           # case variation
    "/admin//users",          # double slash
    "/%61dmin/users",         # URL-encoded 'a'
    "/admin/./users",         # dot segment
    "/static/../admin/users"  # traversal past static exemption
]

for path in admin_paths:
    r = requests.get(
        f"https://victim.com{path}",
        cookies={"session": session},
        allow_redirects=False
    )
    print(f"{r.status_code} {path}")

# Burp Autorize workflow:
# 1. Configure Autorize with the low-privilege user session cookie
# 2. Browse the entire application as the admin user (in the main browser)
# 3. Autorize automatically replays every request with the low-priv cookie
# 4. Flag any request where the low-priv replay returns 200 with the same body
#    as the admin request

# Manual verification with curl
curl -s -H "Cookie: session=<low_priv_session>" 
  https://victim.com/admin/export/users 
  | python3 -m json.tool | head -20

Security Assessment Methodology

Map the admin attack surface — Use endpoint discovery (feroxbuster, JS bundle analysis, Swagger/OpenAPI) to compile a complete list of admin-only paths and API endpoints.
Test forced browsing — Authenticate as a low-privilege user and directly request every identified admin path. Record response codes and body content.
Deploy Burp Autorize — Configure the plugin with the low-privilege session cookie. Browse the entire application as an admin user; Autorize replays every request with the low-priv token and highlights authorization bypasses.
Test path normalization bypasses — For any admin path that returns 403 to a direct request, try case variants, double slashes, URL encoding, dot segments, and traversal sequences.
Test privilege injection — On every POST/PUT/PATCH endpoint, inject admin=true, role=admin, is_admin=1, and account_type=superadmin into the request body.
Test HTTP method confusion — If the admin endpoint returns 403 on GET, try POST with X-HTTP-Method-Override: GET and vice versa.
Verify with two-account testing — Confirm that the low-priv account can perform admin actions, not just read admin data, by testing write and delete operations.

Defensive Countermeasure — Apply role-check middleware at the framework router level for all admin route groups — never rely on hiding links in the UI. Implement a centralized authorization middleware (e.g., Spring Security's @PreAuthorize("hasRole('ADMIN')"), Django's @permission_required, or a dedicated authz library like OPA) rather than per-function checks that can be forgotten. Normalize all incoming URL paths before routing to prevent path-traversal ACL bypass.

Common Assessment Errors

Stopping at 403 on the first path — A 403 on /admin/users does not mean all admin paths are protected; enumerate exhaustively and test path normalization variants.
Only testing GET endpoints — Admin write functions (DELETE user, reset password, promote role) are often the highest-impact targets and may have weaker ACL than read endpoints.
Not using Burp Autorize — Manually replaying admin requests with a low-priv token is tedious and error-prone; Autorize automates this for every request in the session and dramatically increases coverage.
Missing middleware exemptions — URL-based ACL rules frequently exempt /static/, /assets/, and /public/ paths; if an admin endpoint is accidentally placed under an exempted prefix, it is fully accessible.
Assuming admin endpoints require authentication — Some admin endpoints (especially internal health, debug, and metrics endpoints) are not authenticated at all, making the escalation trivially unauthenticated.
Not testing the API layer separately from the UI — The UI may enforce role checks client-side, but the underlying REST or GraphQL API may have no server-side check; always test the API directly, bypassing the UI.

NICE Framework Alignment

Code	Knowledge/Skill/Task Statement	How This Card Develops It
K0007	Knowledge of authentication, authorization, and access control methods	Explains role-based access control failure modes including missing middleware, URL-based ACL bypass, and parameter injection
K0065	Knowledge of policy-based and rule-based access control	Covers URL ACL vs function-level ACL and the need for centralized authorization middleware
K0070	Knowledge of common application vulnerabilities	Identifies forced browsing, path normalization bypass, and parameter injection as vertical escalation techniques
S0001	Skill in conducting vulnerability scans and recognizing vulnerabilities in security systems	Practises forced browsing, Burp Autorize workflow, path normalization testing, and privilege parameter injection
T0028	Task: Identify systemic security issues based on vulnerability and configuration data	Develops the ability to identify missing role-check middleware as a systemic vertical escalation risk across the admin surface
T0570	Task: Conduct authorized penetration testing of systems and networks	Applies a complete vertical privilege escalation assessment methodology in a controlled testing context