$ cat writeup.md…
$ cat writeup.md…
pingCTF
Task: Node/Express PDF review app with Pug templates and admin bot. Solution: Exploit discrepancy between upload-time and view-time PDF text extraction after form flattening to inject XSS via Pug &attributes() spread.
$ cat /etc/rate-limit
Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.
Every good CTF needs a review!
A Node.js/Express application that allows users to upload PDF review forms. An admin bot can be triggered to view the uploaded PDFs. The goal is to steal the flag from the authenticated admin session.
The application uses several key technologies:
pdf_id field/view?formId=<id>async function validatePDF(id) { // ... const htmlTagRegex = /<\/?[a-z][\s\S]*>/i; for (const field of storedFields) { try { const uploadedField = form.getTextField(field); const text = uploadedField.getText(); if (htmlTagRegex.test(text)) return false; // Check field values } catch { return false; } } // ... // Also extracts page text with pdfjs and checks for HTML tags const textContent = await docPage.getTextContent(); // ... if(htmlTagRegex.test(content)) return false; return true; }
The validation checks:
Critical observation: At upload time, form fields are NOT flattened, so pdfjs only extracts static page text, not the form field values.
...
$ grep --similar