Bypassing Role-Based Access Controls via Client-Side Generation & JS Overrides

Introduction

In web application security, there is a golden rule that developers frequently overlook: Never trust the client. Despite decades of security awareness, client-side enforcement remains one of the most common architectural flaws.

During a recent security assessment of a multi-tenant enterprise platform, I stumbled upon an authorization bypass that perfectly illustrates this concept. Here is a technical breakdown of how observing "zero network traffic" led to complete client-side exploitation.

The Target & Visual Indicators

The application utilizes a granular Role-Based Access Control (RBAC) model. Higher tiers, like the Vault Admin, have exclusive access to data extraction tools—specifically, "Export as Excel" and "Export as PDF" functions.

When logged in as a low-privileged user, these options were not removed from the DOM. Instead, they were simply styled with a faded look and marked with the HTML disabled attribute. While hiding or disabling elements in the UI is standard for User Experience (UX), it should never be the sole line of defense.

The "Aha!" Moment: The Silent Network

To understand how the server validated these export requests, I logged into an Admin account, cleared my Network tab, and initiated an export.

To my surprise, no HTTP requests were generated. The file download was instantaneous, and Burp Suite intercepted nothing.

[User Action: Click Export] ---> (Local JavaScript Processes Data) ---> [File Downloads Instantly]
                                              ^
                                      NO SERVER INTERACTION

[User Action: Click Export] ---> (Local JavaScript Processes Data) ---> [File Downloads Instantly]
                                              ^
                                      NO SERVER INTERACTION

This structural pattern was an immediate red flag. If the server isn't processing the export request, it means:

• The dataset is already loaded into the frontend state.
• The compilation, formatting, and rendering of the Excel/PDF files are happening entirely via client-side JavaScript libraries.
• Crucially: The authorization check is happening entirely in the browser.

Overcoming the Frontend Barrier (The React Scope Challenge)

My initial exploitation plan was straightforward: find the client-side function responsible for parsing the data and invoke it directly from the developer console.

However, the application was built using React. Due to React's component scoping and encapsulation, internal functions are not exposed globally on the window object. Attempting to call the handling functions directly from the console resulted in reference errors.

The Exploit: Weaponizing Local Overrides

Instead of trying to extract the encapsulated function, I attacked the logic governing the UI restriction itself.

• Locating the Logic: I searched the formatted JavaScript bundles for references to the export buttons and the state controlling the disabled property.
• Identifying the Check: I discovered a conditional evaluation that checked the user's session object for the role_name property before rendering the component state.
• Modifying Reality: Using the Local Overrides feature in Chrome DevTools, I patched the minified JavaScript file. I intercepted the conditional block and forced the UI evaluation to ignore the role checking, ensuring that the disabled property remained false.

// Original Minified Logic (Concept)
disabled: t.userRole !== "vault_admin"
// Patched Logic via DevTools
disabled: false

// Original Minified Logic (Concept)
disabled: t.userRole !== "vault_admin"
// Patched Logic via DevTools
disabled: false

After saving the override and refreshing the page on the low-privileged account, the buttons became fully active. Because the underlying raw data was already available in the client state, clicking the unlocked buttons triggered the local parsing engine, successfully exporting the restricted datasets without a single complaint from the backend.

Key Takeaways & Remediation

This vulnerability showcases that visual obfuscation is not access control.

• For Pentesters: Always monitor your network tab during high-privilege actions. If an action happens silently on the network, the validation is inherently broken.
• For Developers: If data is sensitive enough to require role restrictions, it must not be shipped to the client-side state of unauthorized users in the first place. Export functionalities should ideally be processed server-side, where session permissions are cryptographically validated against the active database entry.