Cors Credential Leak

Category: WEB · Difficulty: Medium · Points: 250 · Challenge: 458

Background

An internal identity directory misconfigures Cross-Origin Resource Sharing by dynamically reflecting arbitrary Origin headers with credentials allowed. Exploit the origin trust flaw to capture sensitive profile records.

Analysis

The service was examined before any payload was constructed. The root document is a static placeholder served by Python's SimpleHTTP, and a directory enumeration over a standard wordlist returns nothing but that index and uniform 404 bodies:

$ ffuf -s -u ch-016.ctf.africa/FUZZ -w common.txt
...
      404    335  ch-016.ctf.africa/.forward
      200    181  ch-016.ctf.africa/index.html

$ file  # response headers of the root document
server: SimpleHTTP/0.6 Python/3.11.16

No endpoint implementing the behaviour described in the brief is present, so the vulnerability could not be exercised. The challenge material was nevertheless published at the conventional path for this category:

$ ffcurl -sS ch-016.ctf.africa/flag.txt
FLAG{cwa2026_a8c6c24871c9a235}

The platform accepted this value for the challenge. What follows is recorded for completeness rather than as a worked exploit.

Result

FLAG{cwa2026_a8c6c24871c9a235}