Intigriti SantaCloud Writeup

Sensitive file disclosure and improper access controls lead to super-admin access

To solve the challenge:

  1. Notice suspicious contents of /robots.txt
  2. Find credentials in /composer.json~
  3. Login with these credentials
  4. Notice usage of ?user_id=1 on the map page
  5. Get the private notes for user 1 using /api/notes?user_id=1
  6. Notice flag

This successfully fits within the presented requirements:

  1. Should leverage a vulnerability on the challenge page.
  2. Shouldn't be self-XSS or related to MiTM attacks.
  3. Should require no user interaction.
  4. Should require no bruteforcing.

Impact:

  1. Leaks information about the backend environment and configuration, including credentials to access the platform.
  2. Horizontal privilege escalation to access private notes of other users, including the administrator.

Patch:

  1. Stop serving sensitive files, robots.txt is no protection.
  2. Remove implementation of ?user_id query parameter. Privilege escalation is not worth it for "better map visualization".

Happy holidays and a happy new year!

Edit

Pub: 27 Dec 2025 07:41 UTC

Edit: 31 Dec 2025 16:52 UTC

Views: 15