Chocolate Drop — AlfaCTF

Description

Шоколадный дроп

English summary: the target is a Next.js shop application with server-side SQLite-backed sessions, a promo code feature, and a hidden expensive flag item. The goal is to abuse the promo flow to raise the stored balance high enough for checkout.

Analysis

Recon

Source inspection revealed a valid promo code embedded directly in the frontend or bundled source. The code decodes from base64 into the JSON object below:

{"amount":5000,"coupon":"TREAT5000"}

The interesting API route was POST /api/promocode. The handler updated session.balance before fully validating the promo payload:

1. add promo.amount to session.balance
2. later reject malformed data in a catch
3. subtract the same value in the error path
4. always persist the session in finally

That sequence is unsafe in JavaScript because + is both numeric addition and string concatenation.

Vulnerability

After redeeming the legitimate 5000 coupon once, the stored balance is the number 5000. The bug appears when the next promo uses a malformed amount value such as the string "1e305".

At that point the application effectively does:

session.balance += "1e305";

Instead of producing a larger number, JavaScript concatenates and the balance becomes the string:

"50001e305"

Later the error handler tries to roll the change back with -=. That operator forces numeric coercion first:

session.balance -= "1e305";

Now "50001e305" is parsed as an enormous scientific-notation value, which overflows to Infinity. Then the rollback becomes:

Infinity - 1e305 === Infinity

So the failed promo does not restore the original balance. It upgrades it to Infinity.

Persistence quirk

...