Pentest report

[Nagarian]

Following the pentest done by Laluka, we have somes issues to fix for a better security improvment !
You can watch the report replay (in french) here -> https://www.youtube.com/watch?v=Z34a3QQDoa0

• mongo-express
  • impact if ssrf: Mongo Express server listening at http://0.0.0.0:8081/ admin:pass
  • Mongo Express -> Set self as admin, or change player score
  • http://164.92.157.182:8081/db/admin/system.users/"admin.sthack-admin"?skip=0 -> get db admin hash
• race conditions
  • Add extra member to team, no lock // yes, team of 10+
  • Flag double submit // race, but self score decrease 😄
• proto
  • DOS whole site, create team/user/pass "proto", kills the backend
  • username == proto makes invisible user in dashboard
  • proto pollution : TypeError: Cannot read properties of undefined (reading 'proto') : statistics.teams[team].users[username].sockets++ AND [cur.team]: [...(acc[cur.team] ?? []), cur],
• others
  • User Oracle in register
  • storing cleartext flags p1 plz bounty
  • host lpe: sudo usermod -aG docker ubuntu
  • HA: restart: always on all dockers

[Nagarian]

User oracle in register will not be handle since when we can already have the list of all the users when we go into scoreboard screen