# Two account takeover bugs worth $4300 🎁

Path traversal in workspace/user API routes bypassed 403 authorization, letting an attacker change a victim's email and take over the account.

- Payout: $2,500
- Severity: critical
- Program: -
- Credited: Usama Varikkottil
- Disclosed: 2021-08-29
- Write-up quality: 7/10
- Original: https://blog.usamav.dev/two-account-takeover-bugs-worth-4300-dollar-bounty
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-usamav-dev-two-account-takeover-bugs-worth-4300-dollar-bounty
- Tags: domain:api impact:ato kind:bounty platform:blog sev:critical tech:rest technique:chained vuln:access-control vuln:account-takeover vuln:idor vuln:path-traversal

**Target:** REST API workspace and user endpoints
**Root cause:** Authorization check resolved the workspace/user ID from the first path segment (attacker-owned), while the backend acted on the ID after ../ traversal, so ownership check and action target diverged.
**Steps:**
1. Register attacker and victim accounts; note attacker workspace ID `60b64f71adf0d3543cfd8229` and victim workspace ID `60c30f178747147d9acd89ba`.
2. Confirm `POST /workspaces/<victim_ws>/users` with attacker X-Auth-Token returns 403.
3. Bypass with `POST /workspaces/60b64f71adf0d3543cfd8229/../60c30f178747147d9acd89ba/users?sendEmail=true` using attacker token -> 200.
4. Invite victim email to attacker workspace; response leaks victim userId `60c30f168747147d9acd89aa`.
5. Send `PUT /users/60b64f71adf0d3543cfd8225/../60c30f168747147d9acd89aa/email` with attacker token and `{"email":"attacker-mon@gmail.com"}` -> 200.
6. Verification link delivered to new (attacker) email; click it, then request password reset to attacker email to take over victim account.
**How found:** After 403 on cross-workspace requests, tried common 403-bypass tricks (array/object wrapping, method change, API versioning, wildcards, null bytes) all failed; consulted API security checklists and tried `../` path traversal in the route, which succeeded.
**Exploitation:** Attacker needs only victim's email. Invite victim to attacker workspace to leak userId, then use ../ traversal in the user email-change route with attacker's own token to set victim's email to attacker-controlled address; verification link goes to the new email, completing takeover, then password reset.
**Escalation:** Chained IDOR (email change) with userId disclosure via workspace invite response to achieve full account takeover.
**Insight:** When an API authorizes on one path segment but acts on another, try inserting `../` between an attacker-owned ID and the victim ID so the authz check sees your resource while the handler resolves the victim's; also check invite/member responses for userId disclosure.