---
# System prepended metadata

title: Markdown Parser (XSS Scripting)
tags: [ACMcyber, Web]

---

# Markdown Parser (XSS Scripting)

## Description
I built this simple markdown parser. Please give me some feedback (in markdown), I promise to read them all. Current features include: bold, italics, code blocks with syntax highlighting!

Author: ocean
http://challs.nusgreyhats.org:33335 

[code](https://ctfd.nusgreyhats.org/files/29b0bd5a0c29e0dd06ea5e99d85a0eb4/dist-markdown-parser.zip?token=eyJ1c2VyX2lkIjoxNjQ4LCJ0ZWFtX2lkIjo1MDQsImZpbGVfaWQiOjM2Nn0.ZicOdg.nWW38dapftkKXDR0rrEhmujM_w0)

## Solution
Lets start with the code

in admin.js:

```javascript= 

        try {
            await page.setCookie({
                name: 'flag',
                value: process.env.FLAG || 'flag{fake_flag}',
                domain: cookieDomain,
                httpOnly: false,
                samesite: 'strict'
            })
            await page.goto(url, { timeout: 6000, waitUntil: 'networkidle2' })
        } finally {
            await page.close()
            await ctx.close()
        }
```

telling us the flag is in the cookie and we need to find a way to access `document.cookie`

now we look for vunerabilities in markdown code

usually escapeHtml handles blocking this attack however it was not done everywhere in markdown.js

```javascript=
            if (line.startsWith('```')) {
                language = line.substring(3).trim();
                inCodeBlock = true;
                htmlOutput += '<pre><code class="language-' + language + '">';
```

so starting with ``` will allow for your attack

![Screenshot 2024-04-22 at 6.48.31 PM](https://hackmd.io/_uploads/rkn_7qVbC.png)

results in 

![Screenshot 2024-04-22 at 6.48.54 PM](https://hackmd.io/_uploads/r1bcmq4Z0.png)

now let inset the XSS script

for example: 

![Screenshot 2024-04-22 at 6.55.40 PM](https://hackmd.io/_uploads/ryumHqEZA.png)

will result in an alert:
![Screenshot 2024-04-22 at 6.56.07 PM](https://hackmd.io/_uploads/HyMBScE-C.png)

and 
![Screenshot 2024-04-22 at 6.56.23 PM](https://hackmd.io/_uploads/BJQ8S9VZA.png)

to get `document.cookie`

![Screenshot 2024-04-22 at 7.02.13 PM](https://hackmd.io/_uploads/SkZ3U9EWA.png)

and should get


![Screenshot 2024-04-22 at 7.02.35 PM](https://hackmd.io/_uploads/Bkwp85NZA.png)

## Flag

#### grey{m4rkd0wn_th1s_fl4g}