zer0pts CTF 2020 musicBlog — high-level notes

Web challenge musicBlog from zer0pts CTF 2020: share favorite songs; stack described around PHP 7.4.0 in Docker, with a bot/worker that visits posts.

Challenge theme

• Posts run through tag rendering helpers (render_tags / strip_tags allowlist centered on <audio>)
• A worker sets a sensitive value into User-Agent and interacts with posts (like event)—classic “bot XSS / header exfil” CTF shape
• Source discusses a known strip_tags allowlist quirk (slash inside tag names confusing HTML vs PHP filtering)

Vulnerability class / root cause

• Filter bypass / XSS class: server-side strip_tags allowlisting does not match browser HTML parsing, so crafted tags can survive as markup the browser treats differently (e.g. link-like behavior) while still passing the PHP allowlist.
• Combined with a bot that embeds secrets in request headers, that becomes a stored XSS → secret-in-header leakage pattern in the challenge narrative.

Impact (abstract)

In the CTF, the bot’s secret material can be disclosed to an attacker-controlled endpoint. In production analogues: account takeover or token theft via XSS against privileged browsers.

Mitigations / lessons

• Do not rely on strip_tags as an HTML security boundary; use a real HTML sanitizer aligned with browser parsing, or escape and avoid raw HTML.
• Keep secrets out of User-Agent and other automatically echoed headers; use HttpOnly cookies / separate secret channels.
• CSP, strict MIME types, and bot isolation reduce blast radius but do not fix broken sanitizers.

Solve steps and PoC omitted.