> For the complete documentation index, see [llms.txt](https://notes.dollarboysushil.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dollarboysushil.com/web-application-pentest/bugforge/idor-insecure-direct-object-reference/copypaste-slug.md).

# CopyPaste - Slug

**Level:** Easy | **Points:** 10 | **Type:** Daily Challenge

**Overview**

The application allows users to create and manage collections of code snippets. An insecure API endpoint exposes collection metadata without authorization checks, enabling an attacker to enumerate private collections and access their contents using leaked slugs.

<figure><img src="/files/55VieLbIvYaeFY0xXtcV" alt=""><figcaption></figcaption></figure>

Navigating to `/collections`, authenticated users can create collections and group snippets inside them.

<figure><img src="/files/ShOuIH7qvdGrSeTzi5L3" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/sgFb2p9Z66HukmzNNtsf" alt=""><figcaption></figcaption></figure>

**Identifying the Vulnerability**

The endpoint `/api/collections/:id` returns metadata for any collection by its integer ID  including collections owned by other users.

This immediately raises an **IDOR (Insecure Direct Object Reference)** flag, since the IDs are sequential integers with no authorization check.

Querying `collection/2` reveals a collection owned by **admin**:

<figure><img src="/files/BWgBCNtafzV1RVPbP8NE" alt=""><figcaption></figcaption></figure>

**Exploitation**

Two key observations make exploitation possible:

**1. The `is_public` field is set to `1`**\
For public collections, the application uses the collection's `slug` to serve its data, meaning knowing the slug is enough to view the contents.

**2. The slug is leaked by the IDOR**\
Even though this is the admin's collection, the unauthenticated metadata endpoint freely returns its slug.

<figure><img src="/files/zh8BBngE7R0FSkklppN8" alt=""><figcaption></figcaption></figure>

To understand the share URL format, we first inspect our own collection's public link:

```
https://lab[id].labs-app.bugforge.io/collections/share/<slug>
```

Substituting the admin's leaked slug into this URL:&#x20;

<figure><img src="/files/xygT76lzNg3mjLb0DsIb" alt=""><figcaption></figcaption></figure>

This grants full access to the admin's collection, and reveals the flag.

**Root Cause**

The vulnerability is a combination of two weaknesses:

* **IDOR:** `/api/collections/:id` exposes metadata of all collections with no ownership or authorization check
* **Security through Obscurity failure:** the app treats the slug as an access control mechanism, but leaks it via the IDOR endpoint

***

**Remediation**

* Enforce **authorization checks** on `/api/collections/:id`  users should only be able to query collections they own or that are explicitly shared with them
* Do not rely on slugs or tokens as the sole access control mechanism for private resources