Bypassing Authentication

---

MangoMail

In this section, we will cover MangoMail. This web application is vulnerable to an authentication bypass.

There is a login portal on the webpage and nothing else; presumably, this is an internal webmail service.

We will fill out the form with test data and intercept the request with BurpSuite. It is assumed that you are already familiar with this process.

In the POST request, we see the URL-encoded parameters email and password, which were filled out with test data. Unsurprisingly, this login attempt fails.

On the server-side, the authentication function these parameters are being passed to looks like this:

...
if ($_SERVER['REQUEST_METHOD'] === "POST"):
    if (!isset($_POST['email'])) die("Missing `email` parameter");
    if (!isset($_POST['password'])) die("Missing `password` parameter");
    if (empty($_POST['email'])) die("`email` can not be empty");
    if (empty($_POST['password'])) die("`password` can not be empty");

    $manager = new MongoDB\Driver\Manager("mongodb://127.0.0.1:27017");
    $query = new MongoDB\Driver\Query(array("email" => $_POST['email'], "password" => $_POST['password']));
    $cursor = $manager->executeQuery('mangomail.users', $query);
        
    if (count($cursor->toArray()) > 0) {
        ...

We can see that the server checks if email and password are both given and non-empty before doing anything with them. Once that is verified, it connects to a MongoDB instance running locally and then queries mangomail to see if there is a user with the given pair of email and password, like so:

db.users.find({
    email: "<email>",
    password: "<password>"
});

The problem is that both email and username are user-controlled inputs, which are passed unsanitized into a MongoDB query. This means we (as attackers) can take control of the query.

Many query operators were introduced in the first section of this module, and you may already have an idea of how to manipulate this query. For now, we want this query to return a match on any document because this will result in us being authenticated as whoever it matched. A straightforward way to do this would be to use the $ne query operator on both email and password to match values that are not equal to something we know doesn't exist. To put it in words, we want a query that matches email is not equal to '[email protected]', and the password is not equal to 'test'.

db.users.find({
    email: {$ne: "[email protected]"},
    password: {$ne: "test"}
});

Since email and password are being passed as URL-encoded parameters, we can't just pass JSON objects; we need to change the syntax slightly. When passing URL-encoded parameters to PHP, param[$op]=val is the same as param: {$op: val} so we will try to bypass authentication with email[$ne][email protected] and password[$ne]=test

Knowing that [email protected]:test didn't log us in and are therefore invalid credentials, this should match some document in the users collection.

When we update the form parameters and forward the request, we should see that we successfully bypassed authentication.

---

Alternative Queries

Although $ne on both parameters worked to bypass authentication, it is always helpful to have alternatives just in case. One example would be to use the $regex query parameter on both fields to match /.*/, which means any character repeated 0 or more times and therefore matches everything.

db.users.find({
    email: {$regex: /.*/},
    password: {$regex: /.*/}
});

We can adapt this to the URL-encoded form, re-send the request, and we will bypass authentication again.

Some other payloads that would work are:

• email=admin%40mangomail.com&password[$ne]=x: This assumes we know the admin's email and we wanted to target them directly
• email[$gt]=&password[$gt]=: Any string is 'greater than' an empty string
• email[$gte]=&password[$gte]=: Same logic as above

Aside from this, you can mix and match operators to achieve the same effect. Taking a bit of time to understand query operators better will be helpful when you try to exploit NoSQL injection in the wild.