Conversation
Every branch built against this base was failing to build/boot in CI with ExceptionInInitializerError: TypeTag :: UNKNOWN, because lombok 1.18.36 can't reflectively patch JDK 25's javac internals. Baking the fix into the fork's own dc34-ctf base so every future branch inherits it automatically instead of needing a manual per-branch cherry-pick. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…client Total The HtmlTampering task previously accepted whatever 'Total' value the client submitted alongside 'QTY' and marked the assignment as solved whenever that submitted total was lower than the real unit price times quantity - classic client-side price tampering / broken access control, since the price shown to the user comes from a hidden form field the client fully controls. Fix: the server now holds the unit price as a private, authoritative constant and recomputes the expected total itself (quantity * unit price), rejecting any request whose client-supplied Total does not match within a small rounding tolerance. Non-numeric QTY/Total and QTY <= 0 are also rejected. This follows the lesson's own mitigation guidance (HtmlTampering_Mitigation.adoc): 'look up the price ... and calculate the total price again' / 'NEVER TRUST INPUT SENT BY A CLIENT'. Locally verified in WSL: built + booted the app, replayed the original exploit (QTY=1, Total=1) which now returns tamper.failure instead of success, confirmed a legitimate request (QTY=1, Total=2999.99, and QTY=2, Total=5999.98) still returns tamper.success, and confirmed a QTY-only tamper (QTY=100, Total=2999.99) is also rejected.
🏆 WebGoat — CTF Patch Score1 / 69 challenges patched
Commit: 🎉 Your result is on the leaderboard — see where you rank! 🏆 |
Author
|
Closing as part of a full stand-down of this CTF push. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vulnerability
The
/HtmlTampering/taskendpoint (Challenge-7-HTML-Tampering, A01 Broken Access Control) accepted theTotalprice value submitted by the client alongsideQTYand marked the checkout as solved whenever that client-supplied total was lower than the real price. SinceTotalis populated from a hidden HTML form field, an attacker can simply edit it before submitting the form to buy the item at any price.Fix
HtmlTamperingTasknow treats the unit price as a private, authoritative server-side constant and recomputes the expected total itself (quantity * UNIT_PRICE), rejecting any request whose client-suppliedTotaldoes not match within a small rounding tolerance. Non-numericQTY/TotalandQTY <= 0are also rejected. This matches the lesson's own mitigation guidance inHtmlTampering_Mitigation.adoc.Local verification (WSL)
POST /HtmlTampering/taskwithQTY=1&Total=1-> now returns tamper failure (previously returned success).QTY=1&Total=2999.99andQTY=2&Total=5999.98both return success.QTY=100&Total=2999.99) is also rejected.🤖 Generated with Claude Code