Summary
The activity API endpoint does not enforce the hidden-user visibility restriction, allowing any unauthenticated caller to retrieve solve history and activity data for users who have set their profiles to private/hidden.
Details
pwn.college allows users to hide their profiles. When a hidden user's profile URL is visited (e.g. /hacker/<user_id>), a 404 is returned. However, the activity API endpoint at /pwncollege_api/v1/activity/<user_id> returns full activity data for the same user with no visibility check applied.
Because user IDs are sequential integers, an attacker can enumerate IDs to discover hidden users and retrieve their solve history, indirectly showing solves, timestamps and progress information.
PoC
- Identify a hidden user (e.g. /hacker/4912 returns 404)
- Request https://pwn.college/pwncollege_api/v1/activity/4912
- Observe that full activity data is returned with HTTP 200
Impact
Users who opt into profile privacy expect their activity to be non-public. This bypass undermines that privacy guarantee without requiring authentication or special privileges.
Zeeshan12340 Reporter
Summary
The activity API endpoint does not enforce the hidden-user visibility restriction, allowing any unauthenticated caller to retrieve solve history and activity data for users who have set their profiles to private/hidden.
Details
pwn.college allows users to hide their profiles. When a hidden user's profile URL is visited (e.g. /hacker/<user_id>), a 404 is returned. However, the activity API endpoint at
/pwncollege_api/v1/activity/<user_id>returns full activity data for the same user with no visibility check applied.Because user IDs are sequential integers, an attacker can enumerate IDs to discover hidden users and retrieve their solve history, indirectly showing solves, timestamps and progress information.
PoC
Impact
Users who opt into profile privacy expect their activity to be non-public. This bypass undermines that privacy guarantee without requiring authentication or special privileges.