Intigriti SantaCloud Writeup
Sensitive file disclosure and improper access controls lead to super-admin access
To solve the challenge:
- Notice suspicious contents of
/robots.txt - Find credentials in
/composer.json~ - Login with these credentials
- Notice usage of
?user_id=1on the map page - Get the private notes for user 1 using
/api/notes?user_id=1 - Notice flag
This successfully fits within the presented requirements:
- Should leverage a vulnerability on the challenge page.
- Shouldn't be self-XSS or related to MiTM attacks.
- Should require no user interaction.
- Should require no bruteforcing.
Impact:
- Leaks information about the backend environment and configuration, including credentials to access the platform.
- Horizontal privilege escalation to access private notes of other users, including the administrator.
Patch:
- Stop serving sensitive files,
robots.txtis no protection. - Remove implementation of
?user_idquery parameter. Privilege escalation is not worth it for "better map visualization".
Happy holidays and a happy new year!