webPromedium
Lab 224 — ModelVault — Path Traversal via OCI Manifest Digest
hackadvisor
Task: AI model registry with OCI manifest import and blob viewer. Digest parameter in /api/blobs/{digest} is split on colon and used to construct filesystem path without sanitization. Solution: Path traversal via ../../../.. in digest hash portion to read /proc/self/environ, which contains the flag in the FLAG environment variable.
$ ls tags/ techniques/
flasklfipath_traversalpythonnginxalpine_linuxhoneypot_decoyoci_registryblob_storagedigest_validationenvironment_variable_leak
honeypot_flag_identificationpath_traversal_via_digest_parameteroci_manifest_digest_injectionproc_self_environ_leakenvironment_variable_extraction
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 159 — ShareVault — Path Traversal via Filter Bypass in File Download— hackadvisor
- [web][Pro]Lab 404 — MindVault — RCE via eval() in Search Filter Expressions— hackadvisor
- [web][Pro]Lab 237 — MailCraft — SSTI in Email Template Preview— hackadvisor
- [web][Pro]Lab 168 — MetricFlow — Insecure Deserialization via Dashboard Import— hackadvisor
- [web][Pro]Lab 209 — BuildForge — Path Traversal in Static File Serving— hackadvisor