# Object Level access control leads to reading user's full requests, sessions, and error messages

Unauthenticated ELMAH error log endpoint on Yelp's internal Tailored Mail admin tool exposed full HTTP requests and admin session cookies, enabling account takeover.

- Payout: hidden
- Severity: medium
- Program: Yelp
- Found by: mester_x
- Disclosed: 2025-01-18
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2891449
- Library page: https://bugbountylibrary.com/r/h1%3A2891449
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:medium tech:dotnet technique:legacy-endpoint technique:recon vuln:access-control vuln:info-disclosure

**Target:** ELMAH error log endpoint (/tmwebapi/elmah.axd) on internal admin web app
**Root cause:** The ELMAH error log handler at /tmwebapi/elmah.axd was deployed without any authentication or authorization check, exposing stored request logs including cookies and secrets.
**Steps:**
1. Visit `https://proze.yelp.com` — redirects to www.yelp.com, but internal admin tool 'Tailored Mail' exists at `https://proze.yelp.com/app/login`.
2. Request `https://proze.yelp.com/tmwebapi/elmah.axd?page=1&size=100` to list the last 100 logged requests unauthenticated.
3. Click `Details` or request `https://proze.yelp.com/tmwebapi/elmah.axd/detail?id=5A4E7ED8-28E8-4E39-9017-F55E2C9F5371` to read a full log entry containing admin cookies and secrets.
4. Paginate older logs via `https://proze.yelp.com/tmwebapi/elmah.axd?page=100&size=100` to reach historical entries.
**How found:** Noticed the subdomain redirected to the main site but the internal admin login page still resolved; probed for common ASP.NET diagnostic endpoints and found ELMAH's elmah.axd exposed without auth.
**Exploitation:** Attacker browses the unauthenticated ELMAH log, extracts admin session cookies and request data from stored entries, and replays the cookies to hijack admin accounts leading to full ATO.
**Escalation:** Historical log pagination extends the window of harvestable sessions; captured admin cookies escalate to account takeover.
**Insight:** When a subdomain redirects to the main site, the underlying app may still serve paths directly — probe for ASP.NET ELMAH (`/elmah.axd`), and check nested API prefixes like `/tmwebapi/elmah.axd`; ELMAH logs store full request headers including cookies, so exposure equals session theft.