webPromedium
Lab 352 — PipeForge — Content-Type Confusion to Admin JWT Forge to RCE
hackadvisor
Task: CI/CD platform with unauthenticated webhook endpoint that reads arbitrary files via user-controlled filepath parameter (weak path filter). Solution: 3-step chain — arbitrary file read to leak JWT secret from /app/data/.env.secrets, forge admin JWT token, then RCE via admin pipeline execution endpoint that passes commands to child_process.exec().
$ ls tags/ techniques/
command_injectiondockerrcepath_traversaljwtnodejshs256arbitrary_file_readwebhookalpine_linuxexpress_jscicddecoy_flagschild_process_exec
jwt_secret_extractionsource_code_disclosurearbitrary_file_read_via_webhookjwt_forgery_hs256admin_privilege_escalationrce_via_execpath_filter_bypass
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 320 — BuildForge — Path Traversal to RCE via CLI @File Expansion— hackadvisor
- [web][Pro]Lab 114 — APIForge — JWT JKU Header Injection for Privilege Escalation— hackadvisor
- [web][Pro]Lab 38 — PipelineForge — XXE in XML Pipeline Import— hackadvisor
- [web][Pro]Lab 29 — PackForge — Path Traversal to RCE via Template Injection— hackadvisor
- [web][Pro]Lab 12 — NewsGrid — JWT Algorithm Confusion— hackadvisor