Privilege Escalation Using SCIM Provisioning

Hi Fellow Hackers!!!

Happy New Year!!!

This Write-Up is about the same program i mentioned in my another article “https://medium.com/@ronak-9889/admin-account-takeover-ab7535fe0fdb”

As mentioned in that write-up this program introduced new feature called “Custom role” which allows admin to create user with custom permissions. One of the permission which could be assigned was “Access to security section”

As seen above Imagine Admin has created user with the custom role which has only “access to security section” admin permission.

As seen …

access control bug bounty cybersecurity information security privilege escalation