Lab 63 — DataPulse — Insecure Deserialization via Preferences Cookie

hackadvisor

Task: DataPulse analytics dashboard with workspace preferences persisted in a base64-encoded cookie that is deserialized server-side using node-serialize's unserialize(). Solution: Inject _$$ND_FUNC$$_ IIFE payload into the preferences cookie to achieve RCE via child_process.execSync, reading /root/flag.txt.