Lab 122 — BuildStream — RCE via Expression Sandbox Escape

hackadvisor

Task: CI/CD pipeline platform evaluates {{ expression }} syntax in step configurations using Node.js vm module sandbox. Solution: Classic vm sandbox escape via constructor chain traversal (this.constructor.constructor) to break out of sandbox, access process.mainModule, require child_process, and read /root/flag.txt.