Challenge Description

The caas challenge presents Cowsay as a Service, where user input is passed to a backend Node.js Express application that executes the cowsay system command and returns the output.

None

Root Cause of Vulnerability

The application uses the Node.js child_process.exec() function with unsanitized user-controlled input (check the index.js file) :

exec(`/usr/games/cowsay ${req.params.message}`)

Because exec() invokes a system shell, any input provided via req.params.message is interpreted by the shell. This creates a command injection vulnerability, leading directly to Remote Code Execution (RCE).

Impact

  • Execution of arbitrary system commands
  • Reading sensitive files (e.g., flags in CTF environments)
  • Full compromise of the application container.
None

Now Use "cat" command to view the falg.txt

None