Write-Ups
Gears of Web Exploits that Sync in Harmony; SteamCoin Write-up from UNI CTF 2021
Rayhan0x01 shares his exploit analysis from the UNI CTF 2021 event.
Rayhan0x01,
Dec 14
2021
Table of Contents
In this write-up, we'll go over the solution for the medium difficulty web challenge SteamCoin that requires the exploitation of multiple server-side and client-side vulnerabilities. The solution involves a JWT authentication bypass through JKU claim misuse using unrestricted file upload, HTTP request smuggling for ACL bypass, and XSS to CSRF on an automated UI testing service to exfiltrate the flag from CouchDB.
The application at-a-glance
Visiting the application homepage displays a login form and a link to the registration page. Since we don't have an account, we can create an account via the registration page and log in. After logging in, the user is redirected to the following dashboard page:
The Settings page contains an upload form. We are allowed to upload an image or a pdf extension file, and the uploaded file link is displayed after a successful upload: