https://github.com/qeeqbox/vertical-privilege-escalation
A threat actor may perform unauthorized functions belonging to another user with a higher privileges level
https://github.com/qeeqbox/vertical-privilege-escalation
escalation example infosecsimplified metadata privilege qeeqbox vertical visualization vulnerability
Last synced: 10 months ago
JSON representation
A threat actor may perform unauthorized functions belonging to another user with a higher privileges level
- Host: GitHub
- URL: https://github.com/qeeqbox/vertical-privilege-escalation
- Owner: qeeqbox
- License: agpl-3.0
- Created: 2022-04-26T22:31:01.000Z (about 4 years ago)
- Default Branch: main
- Last Pushed: 2025-07-21T06:58:05.000Z (11 months ago)
- Last Synced: 2025-07-21T08:34:00.493Z (11 months ago)
- Topics: escalation, example, infosecsimplified, metadata, privilege, qeeqbox, vertical, visualization, vulnerability
- Homepage:
- Size: 949 KB
- Stars: 3
- Watchers: 1
- Forks: 1
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
A threat actor may perform unauthorized functions belonging to another user with a higher privilege level.
Clone this current repo recursively
```sh
git clone --recurse-submodules https://github.com/qeeqbox/horizontal-privilege-escalation
```
Run the webapp using Python
```sh
python3 horizontal-privilege-escalation/vulnerable-web-app/webapp.py
```
Open the webapp in your browser 127.0.0.1:5142
Login as John (username: john and password: john - The threat actor stole this account)
John has access to the tickets only
Logout
Login as Joe (username: joe and password: joe - The threat actor stole this account)
Joe also has access to the tickets and sysinfo
## Code
This logic checks if the user is logged in, then it renders sections based on the user's access
```py
@logged_in
def render_home_page(self):
content = b""
cookies = SimpleCookie(self.headers.get('Cookie'))
if "access" in cookies:
for access in cookies["access"].value.split(","):
content += getattr(self, f"{access}_section" , None)()
return BASE_TEMPLATE.replace(b"{{body}}",content)
```