webPromedium
Lab 122 — BuildStream — RCE via Expression Sandbox Escape
hackadvisor
Task: CI/CD pipeline platform evaluates {{ expression }} syntax in step configurations using Node.js vm module sandbox. Solution: Classic vm sandbox escape via constructor chain traversal (this.constructor.constructor) to break out of sandbox, access process.mainModule, require child_process, and read /root/flag.txt.
$ ls tags/ techniques/
command_injectionrcenodejsjavascriptnginxexpressdecoy_flagvm_sandboxprototype_chaincicdpipelinetemplate_expression
expression_injectionfile_read_via_rcevm_sandbox_escapeconstructor_chain_traversaldecoy_flag_recognition
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 129 — ReqForge — RCE via VM Sandbox Escape— hackadvisor
- [web][Pro]Lab 54 — PulseGuard — RCE via node:vm Sandbox Escape— hackadvisor
- [web][Pro]Lab 312 — BuildStream — Zip Slip Path Traversal in Artifact Upload— hackadvisor
- [web][Pro]Lab 380 — BuildStream — RCE via Malicious npm Package Preinstall Script— hackadvisor
- [web][Pro]Lab 320 — BuildForge — Path Traversal to RCE via CLI @File Expansion— hackadvisor