webPromedium
Lab 29 — PackForge — Path Traversal to RCE via Template Injection
hackadvisor
Task: NPM package registry (PackForge) with publish API and EJS README rendering; debug mode leaks internal paths. Solution: path traversal in scoped package name writes malicious EJS template to templates directory, then render-readme endpoint triggers SSTI for RCE.
$ ls tags/ techniques/
rcepath_traversalsstinodejsejsinformation_disclosuredebug_modeexpresstemplate_injectionnpm_registryvulnerability_chainingscoped_packages
path_traversal_via_package_nameejs_ssti_to_rcetemplate_file_overwritechild_process_execdebug_endpoint_enumeration
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 320 — BuildForge — Path Traversal to RCE via CLI @File Expansion— hackadvisor
- [web][Pro]Lab 352 — PipeForge — Content-Type Confusion to Admin JWT Forge to RCE— hackadvisor
- [web][Pro]Lab 209 — BuildForge — Path Traversal in Static File Serving— hackadvisor
- [web][Pro]DeployPilot— hackadvisor
- [web][Pro]Lab 116 — InsightForge — IDOR via Undocumented Internal API— hackadvisor