{"id":121,"date":"2026-08-11T18:29:27","date_gmt":"2026-08-11T18:29:27","guid":{"rendered":"https:\/\/skytesting.nl\/?p=121"},"modified":"2026-08-11T18:29:27","modified_gmt":"2026-08-11T18:29:27","slug":"intigriti-challenge-july-2026","status":"publish","type":"post","link":"https:\/\/skytesting.nl\/?p=121","title":{"rendered":"Intigriti Challenge July 2026"},"content":{"rendered":"\n

Improper Authorization checks in ‘Create Manifest’<\/h2>\n\n\n\n

Summary<\/h2>\n\n\n\n

An authorization flaw exists in the ‘Manifest Studio’ functionality in the Registry Observatory app `https:\/\/challenge-0726.intigriti.io\/challenge.html<\/a>‘.<\/p>\n\n\n\n

A user with malicious intent can create a manifest for + view details about packages not part of their own namespace. Potentially sensitive information like the release notes (with a flag in it \ud83d\ude42 can be revealed.<\/p>\n\n\n\n

When creating a new manifest, one can specify the ‘scope’ which refers to the namespace the package is part of. This value is passed to the server in a parameter called ‘manifest_b64’.
The information inside the ‘manifest_b64’ contains the package details including scope definition, and this is by default the namespace value of the current namespace, like for example ‘skyw1per-6a470cf1’ for my account.<\/p>\n\n\n\n

By injecting this JSON formatted data with two packages with both different details, something interesting occurs. The application appears to perform its security boundary checks based on the first package entry, but the second package entry is used in publication.
By specifying a different (existing) package and scope for the second package, a publication can be created for an existing package outside of your own namespace.<\/p>\n\n\n\n

Steps To Reproduce<\/h2>\n\n\n\n

Login <\/h3>\n\n\n\n

Login to the app or create a new account:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Update the manifest<\/h3>\n\n\n\n

Update the manifest for the Hello World package:
Browse to Manifest Studio<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Create a manifest for the package ‘hello-world’ by first clicking on Request Approval<\/code> and second on Run preflight<\/code>. Capture these requests in BurpSuite of Caido.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

This is an example of the intended usage of this feature.
With a successful attempt, the result is visible under Publication History<\/code>.<\/p>\n\n\n\n

Create manifest outside of the namespace<\/h3>\n\n\n\n

Demonstrating the Security boundary: Attempt to create manifest for a package outside of own namespace. Look in Burpsuite \/ Caido History for the request to endpoint \/api\/manifests\/sign<\/code> which is the POST request made when the request approval<\/code> button from step 2 is clicked.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Base64 decoded manifest_b64<\/code> value:<\/p>\n\n\n\n

{\n  \"package\": {\n    \"scope\": \"skyw1per-6a470cf1\",\n    \"name\": \"hello-world\",\n    \"version\": \"1.0.0\"\n  },\n  \"metadata\": {\n    \"description\": \"Compatibility check\",\n    \"visibility\": \"private\"\n  },\n  \"operation\": \"preflight\"\n}<\/code><\/pre>\n\n\n\n
Lets change name to security-notes<\/code> and scope to core<\/code>.
Based on this comment and details, we know this other namespace and package should exist within the application.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
After applying the changes, base64 encode the entire JSON object and replace the manifest_b64<\/code> value in your request.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Expected result: A 401 response with the following error message:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Exploitation<\/h3>\n\n\n\n
Exploitation: Adding two json packages to the payload
Send the request to \/api\/manifests\/sign<\/code> to repeater again. This time, lets use the following payload:<\/p>\n\n\n\n
{\n  \"package\": {\n    \"scope\": \"skyw1per-6a470cf1\",\n    \"name\": \"hello-world\",\n    \"version\": \"1.0.0\"\n  }, \"package\": {\n    \"scope\": \"core\",\n    \"name\": \"security-notes\",\n    \"version\": \"1.0.0\"\n  },\n  \"metadata\": {\n    \"description\": \"Compatibility check 123 test\",\n    \"visibility\": \"private\"\n  },\n  \"operation\": \"preflight\"\n}<\/code><\/pre>\n\n\n\n
Note this payload contains two sets of package<\/code> details. The first one will be used for validation, and should check all requirements. the second one is the one used in the actual publication.
After applying the changes, base64 encode the entire JSON object and replace the manifest_b64<\/code> value in your request.
Expected result: a 200 response with approval_id<\/code>,manifest_sha256<\/code>,nonce<\/code>,expires_at<\/code> and signature<\/code>.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Next, locate the POST request to \/api\/publications<\/code> and edit it in Repeater. For the manifest_b64<\/code> body, use the same value as in the previous request. The other required parameters can be copied from the HTTP response of \/api\/manifests\/sign<\/code>.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Expected result: HTTP 201 response.<\/p>\n\n\n\n
Result<\/h3>\n\n\n\n
Browse in the application to Publication History<\/code>.
The last created item should be the core\/security-notes package, indicating the exploit has been successful.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
The release notes from this package are readable:<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
FLAG:<\/p>\n\n\n\n
INTIGRITI{019f8700-4613-74fb-923e-781903e4bee9}<\/code><\/pre>\n\n\n\n
Impact<\/h2>\n\n\n\n
A user with malicious intent can publish a manifest for a package outside of their own namespace.
Due to this, a new version under “publication history” is created.
The user can view details of this package like the original release notes.
All they need to know is the namespace and the name of the package, no user interaction is required.<\/p>\n\n\n\n
Recommended solution<\/h2>\n\n\n\n
The application should parse the manifest once and use the same package and namespace values for both authorization and publication.<\/p>\n\n\n\n
Ambiguous manifests containing multiple conflicting package entries should be rejected. Before publishing, the server should verify that the authenticated user is authorized to publish to the resolved namespace and package.<\/p>\n","protected":false},"excerpt":{"rendered":"
Improper Authorization checks in ‘Create Manifest’ Summary An authorization flaw exists in the ‘Manifest Studio’ functionality in the Registry Observatory app `https:\/\/challenge-0726.intigriti.io\/challenge.html‘. A user with malicious intent can create a manifest for + view details about packages not part of their own namespace. Potentially sensitive information like the release notes (with a flag in it […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-121","post","type-post","status-publish","format-standard","hentry","category-ctf-writeups"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"_links":{"self":[{"href":"https:\/\/skytesting.nl\/index.php?rest_route=\/wp\/v2\/posts\/121","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/skytesting.nl\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/skytesting.nl\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/skytesting.nl\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/skytesting.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=121"}],"version-history":[{"count":0,"href":"https:\/\/skytesting.nl\/index.php?rest_route=\/wp\/v2\/posts\/121\/revisions"}],"wp:attachment":[{"href":"https:\/\/skytesting.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=121"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/skytesting.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=121"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/skytesting.nl\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=121"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}