static-boundary

Updated 20 Sep 2026

•
Attribution
- •
  Solved by Fauzi Ismail during the competition. These are rn’s study notes based on the teammate’s documented solve, not an independent rn solve.
•
What it asked
- •
  Analyze an Nginx alias mapping and reach a file outside the intended static directory.
•
Approach
- •
  location /assets lacked a trailing slash while alias /srv/www/public/ ended with one.
- •
  For /assets../private/flag.txt, Nginx removes the matched /assets prefix and appends ../private/flag.txt, yielding /srv/www/public/../private/flag.txt.
- •
  The URI never matches location /private/, so that block’s deny all does not protect the resolved file.

Solution

curl --path-as-is \
  -H 'Host: lab.kamsiber.local' \
  'http://10.0.100.6:8080/assets../private/flag.txt'

•
Verification
- •
  The team document records successful flag recovery. The configuration was analyzed offline; the service was not replayed.
•
Concepts
- •
  Nginx alias traversal; URI-to-filesystem mapping; location-boundary mismatch.
•
Source
- •
  Source: team document KMIPNVIII-unintended.docx, titled “Writeup unintended KMIPN 8 Final”. Page numbers refer to the rendered document. Rendered pp. 36–38.
- •
  Flag: KMIPN8{alias_misconfig_exposes_private_files}.