Secure Notes

Technical Walkthrough

Writeup

Challenge

• Name: Secure-Notes
• Category: Web
• Difficulty: Easy
• Mode: hybrid

Summary

Secure Notes is a small Express and Mongoose app with a localhost-only /flag route. The intended break is not header spoofing or SSRF. The bug is the unfiltered /update handler: in the shipped mongoose 7.2.4, a crafted $rename can prototype-pollute __proto__._peername.address, which changes the value later read from req.connection.remoteAddress. Once that polluted value becomes <TARGET>, the live /flag request passes.

Artifact Inventory

The relevant local files were analysis/static/app.js.txt, analysis/static/package.json.txt, and analysis/remote/flag-direct.txt. app.js defines four routes: /flag, /create, /get/:noteId, and /update. package.json pins express 4.18.2 and mongoose 7.2.4, which matters because the exploit depends on version-specific update behavior. The remote surface was minimal: the root page served the notes UI and direct GET /flag returned 403.

Analysis

The critical guard is in analysis/static/app.js.txt: /flag reads req.connection.remoteAddress and only accepts loopback strings. The same source file shows /update doing Note.findByIdAndUpdate(noteId, req.body) with the entire attacker-controlled body and then immediately calling Note.find({_id: noteId}). That combination is enough for the vulnerable Mongoose branch.

Local proof is recorded in analysis/local-validation.md. A non-loopback request to the local test instance returned 403 before exploitation. Creating a note with title set to <TARGET> and then sending:

{
  "noteId": "<id>",
  "$rename": {
    "title": "__proto__._peername.address"
  }
}

caused the follow-up find() to instantiate the polluted path. After that, the same non-loopback /flag request returned the configured test flag. The remote exploit reused that exact chain, which is summarized in analysis/remote/exploit-summary.md.

Solve

The reproducible solver is solve/solve.py. It performs three requests:

1. POST /create with title set to <TARGET>
2. POST /update with $rename: {"title": "__proto__._peername.address"}
3. GET /flag

The script writes the recovered flag to analysis/flag-candidate.txt. The harness command capture-flag then moves the real value into loot/flag.txt, and the transient candidate file is sanitized.

Flag

Raw flag is stored in loot/flag.txt and intentionally not reproduced here.

Lessons

A small trust-boundary check is only as strong as the objects feeding it. Here the route guard itself was simple and correct, but the vulnerable dependency let attacker input rewrite a property that the Node runtime later trusted. When a route passes the full request body into an ORM update call, version-specific operator behavior becomes part of the attack surface.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

• Challenge: Secure-Notes
• Category: Web
• Difficulty: Easy
• Mode: hybrid
• Remote instance: <TARGET>:30993
• Start time: 2026-06-07T17:12:03Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• /flag trusts req.connection.remoteAddress and only permits loopback values, so direct remote access is correctly blocked.
• /update forwards the full JSON body to Note.findByIdAndUpdate(noteId, req.body) and then immediately executes Note.find({_id: noteId}).
• In mongoose 7.2.4, $rename can move attacker-controlled note data into __proto__._peername.address, which is enough to change the address returned by the Node socket getter used in /flag.
• The exploit requires only three remote requests and no header spoofing, SSRF, or client-side behavior.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.

Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Web
• Challenge: Secure-Notes
• Difficulty: Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Hypothesis Board

Keep no more than 3 active hypotheses on Easy/Medium and 5 on Hard unless the user explicitly asks for breadth.

Closed Branches

Memory Summary

approval_required: true

Sanitized Memory Summary

Metadata

• Platform: HackTheBox Challenges
• Category: Web
• Challenge: Secure-Notes
• Difficulty: Easy
• Source workspace: <local workspace>

Validated Solve Chain

Concepts only. Do not include raw flags, reusable credentials, tokens, cookies, private keys, or live secrets.

1.

Reusable Lessons

-

Dead Ends

-

Tool Quirks

-

Evidence Paths

-

Ingestion Decision

• Proposed for LightRAG: yes/no
• Requires user approval before ingestion: yes

Notes

Notes

Scope

• Challenge: Secure-Notes
• Category: Web
• Difficulty: Easy
• Mode: hybrid
• Remote instance: <TARGET>:30993
• Start time: 2026-06-07T17:12:03Z
• Operator: harness
• State file: challenge-state.json

Harness Status

• Current phase: see challenge-state.json
• Next allowed actions: see next-action.json
• Raw flags and sensitive material stay in loot/ only. Do not paste them here.

Artifact Inventory

Evidence Ledger

Key Findings

• /flag trusts req.connection.remoteAddress and only permits loopback values, so direct remote access is correctly blocked.
• /update forwards the full JSON body to Note.findByIdAndUpdate(noteId, req.body) and then immediately executes Note.find({_id: noteId}).
• In mongoose 7.2.4, $rename can move attacker-controlled note data into __proto__._peername.address, which is enough to change the address returned by the Node socket getter used in /flag.
• The exploit requires only three remote requests and no header spoofing, SSRF, or client-side behavior.

RAG / Advisory Memory

RAG output is advisory only. Record evaluated retrievals with:

scripts/challenge_harness.py rag-record <workspace> --query "..." --tag MATCHED|PARTIAL|MISSING|<secret redacted>|GENERIC --validation "..."

Secrets/Flags

Raw flags and sensitive material stay in loot/ only. Use scripts/challenge_harness.py capture-flag to validate and record flag capture without printing the value.