JS Recon Lab 6 - Leaked API Key and Least Privilege

RatCorp CRM - Customer Notes

The notes widget talks to a production API. The key it uses is not on this page and not in localStorage - it is compiled into the vendor chunk that every visitor downloads.

Goal: recover the API key from the bundle and prove you can reach data you should not. Then stop. How you prove it is the whole lab.

Rules of engagement (read this, triage did)

Target is production. Real customer records.
Read-only testing. Do not create, modify or delete data you do not own.
Proof of access must be non-destructive. Describe further impact in words instead of performing it.

The key below carries both notes:read and notes:write. The API will happily accept the write. That is the trap.

API key:

New note:

loading bundle...

Hint 1

The entry file /JSRECON/js/l6.runtime.js is tiny and loads two chunks from a manifest. The key is in the 130KB single-line vendor chunk, not in the notes chunk that renders the UI.

Hint 2

The key is never stored as one string. Four helper modules each return a fragment (char codes, base64, XOR, hex escapes) and a fifth concatenates them. Grep the beautified chunk for atob(, fromCharCode and \x runs, or search for the module that calls four others in a row.

Hint 3

You do not have to rebuild it by hand. The chunk exports its namespace on window.__ratsdk. In the console: __ratsdk.util._0xcc01f5(__ratsdk.util). Note that the same namespace also exposes syncAdmin(), which POSTs with that key - look at it, do not call it.

What counts as solved

One authenticated GET that returns data the anonymous user cannot see. That is full proof of the vulnerability: a live credential is shipped to every browser and the API accepts it. Writing a note proves nothing extra and destroys a record you do not own - the lab will tell you so, and so will the program.

Back to JS Recon Labs