Improper Session Management: Privilege Escalation Through Cookie Manipulation

Lab Type: Web Application Security Category: Broken Access Control | Session Management Tools Used: Burp Suite, Firefox, Kali Linux

Introduction

Session management is one of the most critical aspects of web application security. A session allows a server to identify an authenticated user without requiring them to log in for every request. However, when authorization information is stored on the client side and trusted by the server, attackers may manipulate session data to gain unauthorized access.

In this lab, I analyzed a vulnerable employee portal, identified insecure session handling, and demonstrated how trusting a client-controlled cookie can lead to privilege escalation.

Objective

The goal of this exercise was to:

• Analyze the application’s authentication mechanism.
• Identify insecure session management.
• Understand how authorization decisions were being made.
• Demonstrate the impact of client-side trust.
• Obtain the challenge flag.

Lab Environment

The following environment was used to perform this security assessment:

Operating System: Kali Linux

Web Browser: Mozilla Firefox

Interception Proxy: Burp Suite Community Edition

Target Application: SecureCorp Employee Portal (Intentionally Vulnerable Web Application)

Initial Enumeration

After accessing the login page, I inspected the client-side HTML source code using:

Ctrl + U

While reviewing the source, I noticed an HTML comment that a developer had accidentally left.

Hey John,
Welcome on board.
Use your first name as username
and 'babayaga' as your password.

This immediately revealed valid user credentials.

Login page

View Source showing developer comment

Authentication

Using the discovered credentials, I successfully logged into the application.

After authentication, the Employee Dashboard became accessible.

Traffic Analysis using Burp Suite

To understand how the application handled authenticated sessions, I intercepted requests using Burp Suite.

One of the authenticated requests contained the following cookie:

Cookie:

PHPSESSID=pr3r8g5ee6u464bgpn36v6ibtj;

user_role=employee

Two important observations were made:

• PHPSESSID identifies the user’s session.
• user_role indicates the user’s authorization level.

Unlike the session identifier, the role information was exposed to the client.

This immediately suggested a potential authorization weakness.

Burp Request showing user_role=employee

Identifying the Vulnerability

A secure application should determine a user’s role from trusted server-side session data or another protected mechanism.

In this application, the user’s role was reflected in a client-controlled cookie.

This creates an opportunity to test whether the server is improperly trusting information supplied by the browser instead of enforcing authorization server-side.

Demonstration

The application accepted the client-controlled role information and treated it as the basis for authorization.

As a result, administrative functionality became accessible, confirming that authorization decisions were based on client-side state rather than trusted server-side validation.

Dashboard displaying administrator-level access and the challenge flag

Flag

FLAG{COOKIE_MANIPULATION_SUCCESS}

Root Cause

The application’s authorization logic relied on information that was under the user’s control.

Instead of validating the authenticated user’s privileges on the server, the application trusted a client-side value to determine access rights.

This violates one of the fundamental principles of secure session management:

Never trust authorization information supplied by the client.

Security Impact

If this vulnerability existed in a production environment, an attacker could potentially:

• Escalate privileges
• Access administrator functionality
• Read confidential information
• Modify sensitive records
• Perform unauthorized administrative actions

This is an example of Broken Access Control, one of the most critical categories in the OWASP Top 10.

Mitigation

Developers can prevent this type of vulnerability by:

• Storing user roles only on the server.
• Validating authorization on every request.
• Using server-side session management.
• Never trusting client-controlled authorization values.
• Implementing proper Role-Based Access Control (RBAC).
• Signing or encrypting cookies when appropriate (while remembering that signing alone does not replace server-side authorization).

Key Takeaways

This lab reinforced several important concepts:

• Always inspect client-side source code.
• Small developer mistakes can expose sensitive information.
• Burp Suite is invaluable for understanding how applications manage sessions.
• Session identifiers and authorization data serve different purposes.
• Authorization must always be enforced on the server.

Skills Practiced

• HTML Source Code Review
• Credential Discovery
• Authentication Analysis
• HTTP Request Inspection
• Cookie Analysis
• Session Management Assessment
• Burp Suite Fundamentals
• Broken Access Control Analysis

Conclusion

This lab showed how a failure in securing the session management would result in compromising the whole authentication process in the application. By revealing the authentication information to the client and allowing access based on the client-side information, the application introduced the means of privilege escalation.

Despite the fact that this vulnerability was deliberately designed for the lab environment, it clearly shows a practical security concept: any decision about authorizing access should be based on the reliable state of the server.