> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/cybersecurity-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-access-control-labs/lab-5.md).

# lab-5

## URL-Based Access Control Can Be Circumvented

**Difficulty:** Practitioner

### Lab Description

This website has an unauthenticated admin panel at `/admin`, but a front-end proxy is configured to block external access to that path. However, the back-end framework supports the `X-Original-URL` header, which can be used to override the requested path after the proxy has already made its access control decision.

**Objective:** Access the admin panel and delete the user `carlos`.

### Solution

**Step 1 — Confirm the front-end block**

Capture the main lab page request in Burp and send it to Repeater. Change the URL path to `/admin` and send — the proxy returns an **Access Denied** response. The front-end is blocking requests to `/admin` by path.

**Step 2 — Bypass the block using X-Original-URL**

The back-end framework reads the `X-Original-URL` header and routes the request based on its value, overriding the original URL path. The front-end proxy only inspects the actual URL path, so it sees a benign request (e.g. `GET /`) while the back-end processes `/admin`.

Modify the request as follows:

* Change the URL path to `GET /`
* Add the header: `X-Original-URL: /admin`

Send the request — the admin panel content is returned, bypassing the proxy's access control rule.

**Step 3 — Delete carlos**

To trigger the delete action, the path `/admin/delete` is also blocked at the proxy level. Apply the same technique:

* Keep the URL as `GET /`
* Add `X-Original-URL: /admin/delete`
* Add the username as a query parameter on the main URL: `GET /?username=carlos`

Send the request. A `302` redirect response confirms the delete action was executed. Navigate back to the admin panel (using the same header bypass) to verify `carlos` has been removed.

### Conclusion

The access control was enforced only by a front-end proxy that inspected the URL path. Because the back-end framework honoured the `X-Original-URL` header, an attacker could route requests to any protected path by placing it in the header while using a benign path in the actual URL. Access control must be enforced at the back-end layer, not just at a front-end proxy.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ganesha-hk.gitbook.io/cybersecurity-writeups/port-swigger-access-control-labs/lab-5.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.