Dojo

Dojo #35 - Chatroom Introduction The 35th Dojo Challenge, Chatroom, invited participants to exploit a CWE-73: External Control of File Name or Path vulnerability and read a file containing the challenge flag. YesWeHack asked to produce a qualified report explaining the logic allowing exploitation, as set out by the challenge. Here’s my write-up for this challenge, which unfortunately didn’t make the top 3 :(. Setup Code const child_process = require('child_process') const process = require('process') const path = require('path') const ejs = require('ejs') const fs = require('fs') process....