Executive Summary

This vulnerability exists in MultiJuicer versions 8.0.0 through 10.0.0, specifically in the team join endpoint (POST /multi-juicer/api/teams/{team}/join). The endpoint accepts requests with any Content-Type, including text/plain, which does not trigger a CORS preflight check.

An attacker can exploit this by hosting a cross-site HTML form that auto-submits to the endpoint, causing a victim's browser to log in as the attacker's team without the victim's knowledge or consent.

This attack does not require prior authentication and only requires the victim to visit a page controlled by the attacker while having network access to the MultiJuicer deployment.

The attack works by planting a new session cookie rather than relying on an existing one, so protections like SameSite=Strict on cookies do not prevent it.

In a Capture The Flag (CTF) context, this allows the attacker to inflate their team's score using other players' activity and access any sensitive data the victim enters into the Juice Shop under the attacker's team identity.

This vulnerability was fixed in MultiJuicer version 10.0.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an attacker to hijack your session and force your browser to log in as the attacker's team without your knowledge.

As a result, any actions you take, such as solving challenges in the Juice Shop, will be attributed to the attacker's team, potentially inflating their score unfairly.

Additionally, any sensitive data you enter while logged in under the attacker's team identity could be exposed to the attacker.

This attack requires only that you visit a page controlled by the attacker while having network access to the MultiJuicer deployment, making it relatively easy to exploit.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade MultiJuicer to version 10.0.1 or later, where the issue has been fixed.

Additionally, consider restricting or validating the Content-Type header on the team join endpoint to prevent acceptance of unsafe content types like text/plain.

Ensure users are aware of the risk of visiting untrusted web pages while connected to the MultiJuicer deployment.

Useful 0 Not Useful 0