Bypassing 403 leads to authentication token bypass and access internal resources.

I think you can’t learn anything from my blog!

After completing recon in a website, I found a sensitive endpoint like https://api.example.com/cms/v1/proxy/query. By default, the request is in GET method, and it also needs an authentication token to access the resources.

I started finding the way to bypass 403. Then, I change the method from GET to POST and I saw the response is 200 OK and Authentication token is no longer needed.

Bypassing 403 leads to sensitive data disclosure about back-end functionalities and objects. Bugcrowd considered it as a P3 bug.

It’s really a low hanging fruit.