Core Concept
A web application exposes a sensitive business function (voucher release) through a disabled HTML button. This restriction is enforced only client-side, allowing attackers to bypass the authorization process by manipulating the DOM directly in the browser.
🕵️ Vulnerability Description
On a training or voucher management platform, users encounter a disabled “Request Voucher” button that is intended to be activated only after financial analyst review. However:
- The button’s state is enforced only via HTML attributes (e.g.,
disabled) or CSS classes. - By removing these controls in browser developer tools, the user can manually enable the button and trigger voucher release.
Danger
This is a client-side authorization bypass that allows the attacker to skip business logic validations and access restricted actions.
⚙️ Steps to Reproduce (PoC)
- Navigate to a page with voucher issuance functionality.
- Locate the disabled HTML button.
- Open browser dev tools (
F12), inspect the element. - Remove the
disabledattribute or class. - Click the now-enabled button.
- The system issues a voucher immediately, with no server-side validation.
🎯 Impact Summary
| Category | Description |
|---|---|
| Authorization Bypass | Critical approval logic is enforced only in the front end |
| Sensitive Asset Exposure | Vouchers (with monetary or training value) are released without validation |
| Business Logic Abuse | Anyone with basic web knowledge can exploit this flaw |
| Compliance Risk | Bypasses policy controls; may violate internal or third-party requirements |
🔐 Security Recommendations
- Enforce all business logic server-side. Never rely on front-end controls for access decisions.
- Ensure server-side validation before performing sensitive actions like releasing vouchers.
- Implement CSRF tokens and session checks for all state-changing requests.
- Audit past voucher releases to identify unauthorized activity.
- Use logging and alerting on voucher-related endpoints for anomaly detection.
Warning
Client-side controls (e.g., disabled buttons, hidden fields) should never be used as security mechanisms.