Lab 320 — BuildForge — Path Traversal to RCE via CLI @File Expansion

hackadvisor

Task: CI/CD platform with CLI endpoint using args4j expandAtFiles, allowing @-prefixed args to read server files. Solution: chain arbitrary file read to leak JWT signing key, forge admin token, execute shell commands via /api/admin/script.

rce path_traversal file_read nodejs express cicd jwt_forgery args4j expand_at_files cli_injection

args4j_atfile_expansionarbitrary_file_read_via_cli_parsingjwt_token_forgery_with_leaked_keyserver_side_script_execution

$ ls tags/ techniques/

rce path_traversal file_read nodejs express cicd jwt_forgery args4j expand_at_files cli_injection

args4j_atfile_expansionarbitrary_file_read_via_cli_parsingjwt_token_forgery_with_leaked_keyserver_side_script_execution

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ grep --similar

Similar writeups

[web][Pro]Lab 352 — PipeForge — Content-Type Confusion to Admin JWT Forge to RCE— hackadvisor
[web][Pro]Lab 252 — BuildForge — RCE via npm Lifecycle Script Injection— hackadvisor
[web][Pro]Lab 316 — InsightForge — JWT Secret Leak to RCE via Command Injection— hackadvisor
[web][Pro]Lab 114 — APIForge — JWT JKU Header Injection for Privilege Escalation— hackadvisor
[web][Pro]Lab 209 — BuildForge — Path Traversal in Static File Serving— hackadvisor