webPromedium
Lab 312 — BuildStream — Zip Slip Path Traversal in Artifact Upload
hackadvisor
Task: CI/CD platform with ZIP artifact upload that extracts archives without path sanitization. Solution: craft a malicious ZIP with path traversal (../) to write a Node.js plugin to /tmp/, trigger the build pipeline to execute it, and read the FLAG environment variable from build logs.
$ ls tags/ techniques/
arbitrary_file_writeenvironment_variable_exfiltrationzip_slip_path_traversalremote_code_execution_via_pluginbuild_log_data_exfiltration
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 122 — BuildStream — RCE via Expression Sandbox Escape— hackadvisor
- [web][Pro]Lab 380 — BuildStream — RCE via Malicious npm Package Preinstall Script— hackadvisor
- [web][Pro]Lab 320 — BuildForge — Path Traversal to RCE via CLI @File Expansion— hackadvisor
- [web][Pro]Lab 352 — PipeForge — Content-Type Confusion to Admin JWT Forge to RCE— hackadvisor
- [web][Pro]Lab 209 — BuildForge — Path Traversal in Static File Serving— hackadvisor