МёдХантер II: золотая звезда

avitoctf

Task: A recruitment portal contains one public VIP resume and an authenticated resume importer that performs server-side URL fetches. Solution: Use SSRF to inspect cloud metadata, pull the authorized backend image, and trace its hardcoded VIP predicate.

ssrf go_binary mass_assignment cloud_metadata docker_registry

resume_import_ssrfimds_credential_recoverycontainer_image_extractionstatic_string_analysisxref_analysislive_api_verification

$ ls tags/ techniques/

ssrf go_binary mass_assignment cloud_metadata docker_registry

resume_import_ssrfimds_credential_recoverycontainer_image_extractionstatic_string_analysisxref_analysislive_api_verification

$ cat /etc/rate-limit

Rate limit reached (20 reads/hour per IP). Showing preview only — full content returns at the next hour roll-over.

МёдХантер II: золотая звезда — avitoctf

Description

The organizer description was not preserved verbatim in the task artifacts. The challenge asked which rare work experience makes a resume receive the gold recommended-candidate badge.

Analysis

The public resume list contained nine seeded records. Resume ID 2 was the only record with is_vip: true, and its generated PDF displayed the gold badge. Two direct approaches failed:

copying the visible experience from that resume did not enable VIP status;
sending a top-level is_vip: true field to the resume update API was ignored.

This established that VIP was derived by backend logic and was not ordinary mass assignment.

Continuity from the first task supplied the PDF beta invitation and led to the authenticated endpoint POST /api/seeker/resume/import. The endpoint fetched a supplied URL on the server and returned fetched content when schema validation failed, providing an SSRF-based disclosure primitive. Cloud instance user-data exposed the deployment configuration, including the configured container registry and image name. Sensitive configuration values are intentionally omitted here.

With explicit user authorization for Yandex Cloud registry access, the importer was used only against the IMDSv1 compatibility credential path:

/latest/meta-data/iam/security-credentials/default

This yielded a temporary IAM credential. Access was strictly bounded to the configured challenge image:

cr.yandex/crpml40t8ia2kptf4iv7/hrportal-backend:latest

No unrelated images or registry resources were accessed.

Solution

1. Confirm the derived VIP property

Enumerate public resumes and compare the sole VIP record with normal records. Reusing its visible experience and adding is_vip to an owned resume both leave the authoritative response non-VIP. This rules out visible-value equality and simple mass assignment.

2. Turn resume import into an SSRF disclosure primitive

...