The Ravens session is a serialized object — base64 of JSON — that the server deserializes, reconstructs and trusts, including the role field. Decode it, change the role to admin, re-encode, and the server believes you.
A session page showing the serialized session object and a button to open the session. The server deserializes it and trusts the role field, with no signature and no verification.
Forge the session object to become admin.
You forged the object and became admin.
Why the solution worked
The server rebuilt the object from user data and trusted its fields with no integrity check. Serialized data from the user is untrusted. The fix is signing it, or keeping the session server-side with only a random id at the client.
The root cause
Rebuilding an object from user data and trusting its fields with no check. The root is trusting client-side serialized data.
How the code is fixed
Never trust a client serialized object; keep the session server-side or sign it.
Vulnerable code
const session = deserialize(base64Decode(cookie)); // role trusted as-is
if (session.role === 'admin') grantAdmin();
Safe code
// Keep the session on the server; the cookie is only a random id.
const session = sessionStore.get(cookieId);
if (session?.role === 'admin') grantAdmin();
Impact in the real world
Trusting the serialized object allows role elevation and user impersonation, and in other languages code execution.
How defenders detect it
Defenders sign state or keep it server-side and alert on session objects with unexpected role fields.
