Challenge

A drone control panel built in Node.js/Express. Admin features are restricted.

Approach

  1. The /api/flight-profile endpoint uses _.merge() (or equivalent) to merge user-supplied JSON into a flight profile object without sanitization.
  2. Pollute Object.prototype.isAdmin:
1
2
3
4
5
6

POST /api/flight-profile
{
  "__proto__": {
    "isAdmin": true
  }
}
  1. Subsequent requests check if (req.user.isAdmin) — since isAdmin is now on the prototype, all objects inherit it.
  2. Access the admin panel to retrieve the flag.

Flag

boroCTF{pr0totyp3_p0llut10n_dr0ne_d4sh}