CodeQL CTF: Find the RCE in a Container Platform

At GitHub Satellite, the Security Lab team launched a Capture the Flag (CTF) challenge built around CodeQL, the semantic code analysis engine that powers the newly announced code scanning feature. The contest walks participants through a real vulnerability discovery process, using CodeQL’s taint tracking to hunt down a known bug.

The target is a popular container management platform. The vulnerability itself is a pre-auth Remote Code Execution (RCE) that arises from an arbitrary Java EL expression injection. The specific attack path starts with a user-controlled bean property and flows to a custom error message.

The challenge is designed to teach CodeQL users how to handle cases where the default taint tracking has gaps. Participants will need to fill in those missing links to build a complete data flow path from the untrusted input to the sink. That complete path is the “flag” that wins the contest.

Getting Started with CodeQL

If you’re new to CodeQL or want to warm up before the CTF, GitHub Satellite also featured workshops on using CodeQL to find security vulnerabilities. The Security Lab team has pointed to several resources for learning how to write CodeQL queries:

About the Security Lab CTF

The CTF is organized by the GitHub Security Lab, whose mission is to help the community secure open source software. The contest offers a hands-on way to improve your CodeQL skills while contributing to that goal. You can join the challenge and see how far you can trace the tainted data.