Stage 1 and 3 of that chain are shocking. I mean, yes, security is very hard, especially in a large codebase, but they look like actively made misguided choices.
Stage 1: one endpoint checks for the token header existence, not its content. From the writeup I'm guessing all the other endpoints do check the content, so why?
Stage 3: checks if the URL starts with http://127.0.0.1, not if the domain is 127.0.0.1, to expose an admin token. Ouch.
Stage 1: one endpoint checks for the token header existence, not its content. From the writeup I'm guessing all the other endpoints do check the content, so why?
Stage 3: checks if the URL starts with http://127.0.0.1, not if the domain is 127.0.0.1, to expose an admin token. Ouch.