webPromedium

DeployPilot

hackadvisor

Task: Express.js deployment dashboard with EJS templates, /reports/preview endpoint passes query params to res.render() as EJS options. Solution: WAF bypass using + instead of %20, then EJS SSTI via outputFunctionName option (CVE-2022-29078) to achieve RCE and read /root/flag.txt.

$ ls tags/ techniques/
waf_bypassrcesstinodejsejsexpresstemplate_injectioncve_2022_29078
ejs_outputfunctionname_sstiwaf_bypass_plus_encodingquery_param_to_render_options_pollutionbracket_notation_rce
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups