Summary
An authorization flaw in the poll management feature allows any authenticated user to pause or resume any poll, regardless of ownership.
The system only uses the public pollId to identify polls, and it does not verify whether the user performing the action is the poll owner.
As a result, any user can disrupt polls created by others, leading to a loss of integrity and availability across the application.
Details
When a poll owner pauses or resumes their poll, the frontend sends a request containing only the pollId.
The backend endpoint responsible for handling these actions does not perform an authorization check to ensure the user owns the poll.
Affected Endpoints
-
/api/trpc/polls.pause
-
/api/trpc/polls.resume
Root Cause
- Missing server-side validation of ownership or permissions before changing a poll’s state.
PoC
Test Environment Setup
Target: Local Rallly instance – http://192.168.11.109:3000/
User A (Victim): fairalien – Poll owner
User B (Attacker): hehe – Regular user
Steps to Reproduce
-
User A (poll owner) creates a new poll.
→ Example URL: http://192.168.11.109:3000/polls/abc123
-
User B (attacker) logs in with a regular account.
-
User B intercepts a legitimate pause or resume request using a proxy tool.
- Modify pollId and forward request
- Observe results
Impact
This issue allows any logged-in user to pause or resume polls created by others, disrupting ongoing polls and manipulating availability.
Impact Type
-
Integrity: Unauthorized users can change the state of another user’s poll.
-
Availability: Attackers can repeatedly pause active polls, making them inaccessible to participants.
alaeddine03 Reporter
Summary
An authorization flaw in the poll management feature allows any authenticated user to pause or resume any poll, regardless of ownership.
The system only uses the public
pollIdto identify polls, and it does not verify whether the user performing the action is the poll owner.As a result, any user can disrupt polls created by others, leading to a loss of integrity and availability across the application.
Details
When a poll owner pauses or resumes their poll, the frontend sends a request containing only the pollId.
The backend endpoint responsible for handling these actions does not perform an authorization check to ensure the user owns the poll.
Affected Endpoints
/api/trpc/polls.pause/api/trpc/polls.resumeRoot Cause
PoC
Test Environment Setup
Target: Local Rallly instance – http://192.168.11.109:3000/
User A (Victim): fairalien – Poll owner
User B (Attacker): hehe – Regular user
Steps to Reproduce
User A (poll owner) creates a new poll.
→ Example URL: http://192.168.11.109:3000/polls/abc123
User B (attacker) logs in with a regular account.
User B intercepts a legitimate pause or resume request using a proxy tool.
Impact
This issue allows any logged-in user to pause or resume polls created by others, disrupting ongoing polls and manipulating availability.
Impact Type
Integrity: Unauthorized users can change the state of another user’s poll.
Availability: Attackers can repeatedly pause active polls, making them inaccessible to participants.