Lab: Exploiting server-side parameter pollution in a REST URL
Summary: PortSwigger's lab walks through exploiting server-side parameter pollution in a REST URL: a password reset request places the username value into the path of a server-side API call without escaping, which the tester confirms by submitting URL-encoded administrator# and administrator? and getting Invalid route errors. By traversing with ../../../../ to reach openapi.json, the tester finds the endpoint /api/internal/v1/users/{username}/field/{field}, then injects field=passwordResetToken against API version v1 to return a password reset token, resets the administrator password, logs in, and deletes carlos.
What you should know: A single unescaped username parameter let the tester walk out of the API root, read the OpenAPI definition, and pull a live administrator password reset token - the full chain from one input field to account takeover.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026