webPromedium

Lab 260 — VaultDrop — Path Traversal via Buffer.prototype.utf8Write Monkey-Patching

hackadvisor

Task: Node.js file-sharing platform with workspace automations that run JavaScript in a sandbox; readFile API validates paths via path.resolve() + startsWith(). Solution: Monkey-patched Buffer.prototype.utf8Write to inject a traversal path after path.resolve() normalization, bypassing the startsWith check while the OS resolves ../ components to read /root/flag.txt.

$ ls tags/ techniques/
path_traversalnodejsjavascriptexpressdecoy_flagsandbox_bypassbuffer_prototypemonkey_patchingautomation_sandbox
buffer_utf8write_monkey_patchpath_resolve_bypassstartswith_check_bypassprototype_method_override
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups