Authentication bypass using root object or Empty array.
Last Update: 23 May 2022
Added the ananlysis section with more details
Hey Hunters! Today we have a new write-up about one of my findings at a pentesting client. The method we used to bypass is tricky, and I want to share it with the community, so let’s get started.

Overview
The client performs his login process by sending your credentials and receive the response in JSON data. The trick is to put your credentials inside the root
object and if the backend have an object with this name, it will work.
Note that the target used Cloudflare as server, so it will be hard to focus on injections.
Steps to reproduce
1. Try to log in with dummy credentials to check the request and the response.

You will notice that the credentials are sent in JSON data, and the response also will be in JSON. At this point, I’ve tried multiple tricks like:
Change false to true → Failed
Change the message to “Success” → Failed
Delete the whole msg → Failed
Delete the status → Failed
2. It’s time to play with the request JSON data, let’s try to convert it to XML to test XXE but no luck, no response returned.


3. Okay, let’s return it back to JSON using the same extension and send the request again.


Figure out the change happened after converting it using the extension, and that’s why the response returned the data that related to the default user.
4. Try to intercept the login request and change the JSON data as we tried before and forward the request.
Change the data from
{"email":"test@aykalam.com","password":"test"}to be like that
{"root": {
"password": "test",
"email": "test@aykalam.com"
}}

4. You will find yourself logged in as an admin.

Analysis
After trying more and dig deep with Live OverFlow and my teammates Ahmed Hesham, Karim Hany and Mohamed Saleh we discovered the issue.
The target uses custom framework and also the default case of a custom function that deals with the login process. I will give you an easy example to clear the weakness points, it’s just JS code, not the exact used one.
If you check the following code.

You will notice that the used IF statements are not configured well, if the IF statements conditions are false, the process will not terminate, and it will be continued. This issue can let you bypass the authentication.
So, if you tried to replace the login POST data to empty, it will get the same results
Replace the following
{"email":"test@aykalam.com","password":"test"}With
{"":""}
