CDNio

It is being used gunicorn:

JWT tokens are being used:

I’ll create an account:

I can now use the endpoint /search to find valuable info about myself:

If you capture this request you can see the JWT token:

Furthermore, there is another endpoint called /visit inside /app/bot/routes.py:

Inside the visit() function there is a call to another function called bot_thread(uri), so I’ll inspect it:

Basically if you append the Authorization header it makes a request to a file I specify, so I’ll try it:

Inside /app/main/routes.py there is a conditional which matches just subpaths starting with profile:

So I’ll repeat what I did before but trying one extension cached by Nginx:

Now I can perform a GET request as the code says to /profile.png:

Procedure:

1. Log in as a regular user: register, log in, and obtain a JWT.
2. Send a POST request to /visit with JWT token in Authorization header {"uri": "profile.png"}.
3. The bot logs in as admin and makes a GET request to /profile.png.
4. Nginx sees the .png extension, matches the caching rule, and stores the backend’s response (the JSON containing the admin’s data).
5. After a short while, you make a GET request to /profile.png.
6. Nginx already has the cached response and serves it to you without requiring a token, exposing the admin’s sensitive data (including the api_key/flag).