5 ms·

> If you grab the list of admin users from /orgs/0/users, you can splice a new entry into it giving you full access to their Administrator dashboard. I'm not c

• iamflimflam1 3y ago
  Once he had access to Firebase (the database) he was able to add an entry to the list of admin users. With that done he could login as an admin user to the website and access the administrator dashboard.
• urbandw311er 3y ago
  I read this as worse - splice being a client side JavaScript function to add items to arrays. My concern here is whether the “is admin user” perms checks were done solely on the client side and not enforced on the API endpoint!
  • missblit 3y ago
    He's using the word as meaning "insert", not the JS function. He is saying he inserted a new row into a database to get admin access to a dashboard. 'splice" means to join two things as if by weaving them together. If used as "splice into" or "splice in" there is a sense of breaking something apart, inserting something into the gap, and joining it back together. This all makes a bit more sense if you look up the etymology which was about ropes (despite splicing being about uniting, it's closely related to the word 'split').
  • specialp 3y ago
    It doesn't look like an IDOR attack. The poster says they had read/write access to the Firebase DB with their Firebase user they registered. It appears they had the database entirely open to all Firebase users. I agree the usage of "splice" in a JavaScript context does imply that they had an IDOR exploit