webPromedium
Lab 385 — SprintForge — Prototype Pollution to RCE via React Flight Protocol
hackadvisor
Task: Next.js 15.2 agile project management app using React Server Actions via Flight Protocol with unsafe deep merge on settings payload. Solution: Prototype pollution via __proto__.shell in multipart form field triggers RCE through notification dispatch system, leaking FLAG from environment variables.
$ ls tags/ techniques/
rcenodejsreactprototype_pollutionnextjsmultipart_form_dataflight_protocolserver_actionshoneypot_flagdeep_merge
honeypot_flag_identificationenvironment_variable_exfiltrationprototype_pollution_via_deep_mergereact_flight_protocol_exploitationshell_command_execution_via_polluted_property
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 227 — InsightPulse — Flight Protocol Deserialization to RCE— hackadvisor
- [web][Pro]Lab 240 — DeployForge — Prototype Pollution to RCE via Lodash Merge— hackadvisor
- [web][Pro]Lab 319 — PageForge — Chained Path Traversal to RCE via Asset Bundler— hackadvisor
- [web][Pro]Lab 116 — InsightForge — IDOR via Undocumented Internal API— hackadvisor
- [web][Pro]Lab 129 — ReqForge — RCE via VM Sandbox Escape— hackadvisor