During SEETF 2023, I participated as a member of the TCP1P team and successfully solved several web challenges.
In this article, I will provide a write-up for a specific challenge called "Express JavaScript" that exploits the latest npm module, EJS.
Before we begin, let me explain what EJS is. EJS is a rendering engine used to render files. It allows you to embed JavaScript code within your HTML templates, enabling dynamic content generation. With EJS, you can easily combine static HTML markup with dynamic data, making it a popular choice for server-side rendering in Node.js applications.
In this scenario, we will explore the exploitation of the latest version of the EJS engine, specifically version 3.1.9. This particular version is often targeted by attackers in various Capture The Flag (CTF) challenges.
You might be wondering how I discovered this vulnerability. I became aware of it through JustCTF, a CTF event that occurred one week prior to SEETF. Thanks to the generosity of fellow CTF participants, who shared their solvers, we were able to leverage the EJS vulnerability in this particular challenge.
In the image below, you can see the script we utilized to exploit the "Perfect Product" challenge. We will dive into the details of this exploit later in the article.
After the previous explanations, let's now delve deep into the challenge.
My first JavaScript project.
You can download the challenge files from this link: https://play.seetf.sg/uploads?key=0bac9b2503016f3c98842f6235a565c568df88a10d4b5061bad72ed6acbfd678%2Fdist_express-javascript-security_31d3740ae934682d8c36d3a3182c29981e0c9909.zip
mirror: You can also find the challenge files in this Google Drive folder: https://drive.google.com/drive/folders/1M8vlQ788iRMm9b5Wc7tabsNiSJYTaCdw Challenge Author: zeyu