Lab 328 — DataNest — NoSQL Operator Injection in Authentication

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: json_content_type_injection, mongodb_query_operator_injection, nosql_injection_ne_operator, team_page_enumeration

Summary

Walkthrough of the CUSTOM Web Lab 328 — DataNest — NoSQL Operator Injection in Authentication. Task: Analytics dashboard with role-based access control, login accepts JSON. Solution: NoSQL operator injection using $ne operator to bypass password authentication and access admin settings.

Description

DataNest is a unified analytics dashboard built by NestMetrics Corp. It allows teams to create custom dashboards, track key metrics, manage data sources, and generate reports. The platform features role-based access control with admin and viewer roles, API key management for integrations, and a team collaboration system.

Goal: Find a vulnerability that allows access to admin-only areas and retrieve the flag hidden in the system settings.

Credentials provided: user@test.com / password123

Hint: Pay attention to the team page — it reveals email addresses and roles of all users. What kind of request does the login form make? ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: Analytics dashboard with role-based access control. Goal is to bypass authentication and access admin-only Settings page to retrieve the flag.

Analysis

1. Technology Stack: Express/Node.js backend identified from X-Powered-By header
2. Information Disclosure: Team page at /dashboard/team reveals all user accounts including admin emails:
   • admin@datanest.io (Rachel Nguyen - admin role)
   • service@datanest.io (DataNest Service - admin role)
3. Vulnerability: Login endpoint accepts JSON Content-Type, suggesting MongoDB backend. User input is passed directly to MongoDB query without sanitization, allowing query operator injection. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Initial Reconnaissance

Login with provided credentials and explore the application:

• URL: https://dcde68ea-de57-45e1-b5ef-3b8dda52e807.labs.hackadvisor.io/
• Credentials: user@test.com / password123
• Identified Express/Node.js from response headers

Step 2: Enumerate Admin Accounts

Access the Team page at /dashboard/team to find admin accounts:

• admin@datanest.io (Rachel Nguyen - admin role)
• service@datanest.io (DataNest Service - admin role)

Step 3: NoSQL Operator Injection

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The login endpoint accepts JSON and passes it directly to MongoDB. Use the $ne (not equal) operator to bypass password authentication:

 bash read-only • copy allowed Copy
curl -X POST "https://dcde68ea-de57-45e1-b5ef-3b8dda52e807.labs.hackadvisor.io/login" \
  -H "Content-Type: application/json" \
  -d '{"email":"admin@datanest.io","password":{"$ne":""}}'

Response: {"success":true,"redirect":"/dashboard"}

This creates a MongoDB query:

 javascript read-only • copy allowed Copy
db.users.find({email: "admin@datanest.io", password: {$ne: ""}})

The query returns the admin user because their password is NOT equal to an empty string (any non-empty password matches). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 4: Access Admin Settings

With the admin session cookie, navigate to /dashboard/settings and find the flag in the api_rate_limit configuration field.

Technical Details

Vulnerability Type: NoSQL Operator Injection (CWE-943)

Root Cause: User input from JSON body is passed directly to MongoDB query without sanitization or type checking. MongoDB interprets objects like {"$ne": ""} as query operators.

Attack Vector: Replace string password with object containing MongoDB query operator:

• $ne (not equal) - matches if field is not equal to value
• $gt (greater than) - matches if field is greater than value
• $regex - matches if field matches regex pattern ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Remediation:

1. Validate input types (ensure password is string, not object)
2. Use parameterized queries or ODM with strict typing
3. Sanitize input to remove $ prefixed keys

Notes

• Challenge included a decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} hidden in HTML comments as a honeypot for automated scanners
• The real flag was only accessible in the admin-only Settings page ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering json_content_type_injection, mongodb_query_operator_injection, nosql_injection_ne_operator, team_page_enumeration was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-27 • CUSTOM • Lab 328 — DataNest — NoSQL Operator Injection in Authentication • Difficulty: Easy