Lab 260 — VaultDrop — Path Traversal via Buffer.prototype.utf8Write Monkey-Patching

hackadvisor

Task: Node.js file-sharing platform with workspace automations that run JavaScript in a sandbox; readFile API validates paths via path.resolve() + startsWith(). Solution: Monkey-patched Buffer.prototype.utf8Write to inject a traversal path after path.resolve() normalization, bypassing the startsWith check while the OS resolves ../ components to read /root/flag.txt.