Пчелиное правительство

avitoctf

Task: A government portal exposed signed documents, a HoneyOffice API, and an Intercom support widget without verified identities. Solution: Impersonate the Queen by email, recover her administrator API key from support history, and delete the decree.

information_disclosure intercom openapi broken_authentication api_key

intercom_identity_impersonationpublic_key_uid_extractionbearer_token_abuse

$ ls tags/ techniques/

information_disclosure intercom openapi broken_authentication api_key

intercom_identity_impersonationpublic_key_uid_extractionbearer_token_abuse

$ cat /etc/rate-limit

Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.

Bee Government — avitoctf

Description

Парламент расширил полномочия пограничной службы, а Королева объявила медоедов недружественным видом. Требовалось незаметно удалить королевский указ.

The target was a React government portal. The objective was to delete the Queen's decree, but an ordinary citizen session did not have sufficient permission to call the document deletion API.

Analysis

Mapping the document API

The React bundle and /honeyoffice-openapi.yaml exposed the relevant HoneyOffice surface:

decree document ID 1;
GET /api/documents/1/archive for a verification archive;
DELETE /api/documents/1 for deletion;
bearer API keys beginning with the public format marker hof365_.

The changelog explained that support agents issue HoneyOffice keys through chat. The frontend initialized Intercom application r84vggjn with the logged-in email, but did not supply a server-generated Intercom Identity Verification user_hash. Consequently, the browser—not the application server—asserted which portal user was opening Messenger.

Finding a privileged identity

The public archive contained only the decree PDF, its detached signature, and the Queen's public PGP key. It contained no private key or hidden credential. Nevertheless, the public key provided the identity needed for the chat attack:

unzip -l decree.zip
unzip -p decree.zip queen-public-key.asc > queen-public-key.asc
gpg --show-keys --with-colons queen-public-key.asc

The output disclosed the UID Queen <[email protected]> and fingerprint 6F7AAEBFED593D02875485043089457CA0DEF0BC. The fingerprint also matched the metadata returned by /api/documents.

Root cause

Missing Intercom Identity Verification allowed an attacker to submit any victim email to Messenger and inherit that person's support identity and history. The signed public document supplied the privileged Queen's email, turning the identity-verification failure into administrator API-key disclosure.

The third-party Intercom endpoint was tested only after explicit scope authorization covered the discovered Intercom origins.

Solution

1. Open Messenger as the Queen

...