Cyber Apocalypse Day #5: Ippsec attacks the testimonial GRPC webapp

A path traversal vulnerability in the "Testimonial" CTF challenge allows attackers to exploit a Go gRPC service to write and read arbitrary files by bypassing input filtering through direct gRPC calls. 3:54

Key Takeaways:
• The challenge uses Go with gRPC and Go templating to serve dynamic content, where the HTTP interface filters bad characters but gRPC calls bypass this filter 4:43.
• A path traversal vulnerability exists in the testimonial submission endpoint, which writes files to /public/testimonials and triggers a rebuild via Air when files change 17:11.
• By crafting a malicious gRPC request with a path like ../../view/home/index.html, an attacker can write a custom template that reveals the flag when the app rebuilds 24:57.

This demonstrates how modern CTFs combine new technologies like gRPC with classic vulnerabilities, emphasizing the need for strict input validation and secure file handling.

Sources:

• 3:54 Overview of the "Testimonial" challenge and its design goals.
• 4:43 Discussion of Go templating and gRPC integration.
• 17:11 Identification of the path traversal vulnerability.
• 24:57 Exploit method using gRPC to write a template file and retrieve the flag.