Lab 168 — MetricFlow — Insecure Deserialization via Dashboard Import

hackadvisor

Task: Flask analytics platform imports dashboard configs in .mfx format (base64-encoded pickle) via POST /dashboards/import without validation. Solution: craft malicious pickle with __reduce__ returning eval() that executes subprocess.check_output() and wraps output in a dict matching expected schema; flag appears in dashboard name via flash message.