Researcher Achieves SSTI-Based Defacement of First Partner Bank Web Service on Standoff 365

A researcher publishing under the handle grizzzer has published a detailed account of how a critical event was completed on the Standoff 365 online polygon: defacing the digital banking web service of First Partner Bank.

The target application ran at dbo.fpb.stf. Initial reconnaissance used a DNS zone transfer from the authoritative server at 10.124.1.34, which disclosed four hosts including the banking service itself.

After adding the discovered hosts to /etc/hosts, the researcher opened the login page and used Wappalyzer to identify the technology stack: React, Express, and Node.js. An interesting server-rendered endpoint was found at /docs-server/receipt that accepted an email parameter and returned HTML generated by a server-side template engine.

Fuzzing additional parameter names with Burp Suite Intruder revealed that the undocumented pretty parameter was interpreted by the Pug template engine because the application passed the entire req.query object into pug.renderFile via the spread operator. This classic SSTI condition allowed an attacker-controlled value to be injected into the generated JavaScript output.

A carefully crafted payload closed the existing string context and used process.mainModule.require to import the net and repl modules, establishing a reverse shell that provided an interactive Node.js REPL. From this shell the researcher located the file /app/public/locales/en/translation.json, which contained interface strings loaded by the React frontend.

Using a single writeFileSync command, the value of the info.welcome-to key was replaced with the string pwned by VON. Because the React application fetches the JSON file on every page load, the modified text immediately appeared on the authorization page for all users without requiring a server restart.

The complete attack path was: DNS AXFR reconnaissance, parameter fuzzing, exploitation of Pug SSTI, Node.js RCE, and modification of the localization file. The researcher emphasized that the root cause was unsafe handling of user input inside the template engine and provided several concrete mitigation steps, including restricting DNS zone transfers, updating Pug to version 3.0.3 or later, and avoiding direct forwarding of query parameters into template options.