webhard

gap

0xl4ugh

Task: Achieve RCE on an Express.js app using consolidate.js with lodash as template engine. Solution: Exploit lodash template imports option by passing a destructuring default value as an object key, which gets evaluated as code when the corresponding value is an empty object, bypassing JSON's inability to represent undefined.

$ ls tags/ techniques/
rcesstinodejslodashtemplate_injectionconsolidate
lodash_template_injectiondestructuring_default_bypassimports_option_abuse
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]