A Go Race Condition Enables File Reads in a CTF Challenge

Summary

A CTF challenge exposed a Go race condition: concurrent requests could reset a shared error variable and bypass a path check to read the flag file. The video explains the bug and exploit.

Key points

• The challenge’s Go HTTP handlers process requests concurrently and share an error variable because one assignment uses = rather than declaring a new variable.
• The path check sets the shared error when a request targets flag.txt, but another request can reset it to nil before the check completes.
• By repeatedly sending requests to trigger that race, the exploit can bypass the path check and read the flag file.
• The video also describes an unintended route: examining other processes’ file descriptors through /proc could reveal a flag file opened by a challenge health check.
• The challenge used a separate backend process per session, limiting race-condition interference between teams.