> For the complete documentation index, see [llms.txt](https://ctf.laet4x.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ctf.laet4x.com/ctf-2022/htb-cyber-apocalypse-2022-intergalactic-chase/2-web-300-blinkerfluids.md).

# 2️⃣ Web 300: BlinkerFluids

<figure><img src="https://382757542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfAxmqRz869b0dQQ6DjHW%2Fuploads%2FT3SdlN9OXGLteoPjmhmC%2F1.png?alt=media&amp;token=34d8cb67-0101-46dc-accc-ebd3baf4522d" alt=""><figcaption></figcaption></figure>

The challenge contains of web app and a source code. The page contains of markdown editor and after submission it convert the text to pdf.

Reviewing the source code and its node.js, basically checking the packages.json for possible vulnerable packages, that's where I notice the md-to-pdf package.

<figure><img src="https://382757542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfAxmqRz869b0dQQ6DjHW%2Fuploads%2FmISQGAqLXpRMSkLiu8HY%2F2.png?alt=media&amp;token=9c002b4d-1763-4277-bd20-209f6e81a33c" alt=""><figcaption></figcaption></figure>

Then I tried to searched for possible exploit and found RCE on snyk.io : <https://security.snyk.io/vuln/SNYK-JS-MDTOPDF-1657880>

<figure><img src="https://382757542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfAxmqRz869b0dQQ6DjHW%2Fuploads%2FDhNKQyi2yPOCaJK3EIF9%2F22.png?alt=media&amp;token=b72595cf-c520-42f3-9277-450e4185d9b7" alt=""><figcaption></figcaption></figure>

Which leads me to check to the github issues where I found an interesting comment.

<figure><img src="https://382757542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfAxmqRz869b0dQQ6DjHW%2Fuploads%2FFLw9QFIMRmKm46GG5dG8%2F23.png?alt=media&amp;token=be12d463-8a0e-44b7-a74e-a981dc27a59b" alt=""><figcaption></figcaption></figure>

I created an RCE code and supplied it to the markdown editor and I click submit.

<figure><img src="https://382757542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfAxmqRz869b0dQQ6DjHW%2Fuploads%2FYQCh78VGf4Mc0eFmyLHT%2F3.png?alt=media&amp;token=a423260e-ddfb-4b2b-b417-534c779491af" alt=""><figcaption></figcaption></figure>

Then, I created another markdown to check if the rce2.txt is created, and it listed all the files which the rce2.txt has been created.

<figure><img src="https://382757542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfAxmqRz869b0dQQ6DjHW%2Fuploads%2FoFgXb9v2SPv4TSMRvhb7%2F4.png?alt=media&amp;token=7b54408f-6056-4191-ab6f-fbe8e4fd992a" alt=""><figcaption></figcaption></figure>

I created a final markdown content to read the rce2.txt, then i got the flag.

<figure><img src="https://382757542-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FfAxmqRz869b0dQQ6DjHW%2Fuploads%2FabE1Dftzdmb0HKm1s4NX%2Fflag.png?alt=media&amp;token=583ecf2e-03d1-43b5-bc5e-027a2a9be702" alt=""><figcaption></figcaption></figure>

Conclusion: ***Package vulnerabilities help me get the flag that highlighted the importance of source code review.***