Lab 319 — PageForge — Chained Path Traversal to RCE via Asset Bundler

hackadvisor

Task: Express.js CMS with asset bundler path traversal, config file secrets disclosure, and node-serialize deserialization RCE. Solution: 3-step chain — absolute path traversal with URL fragment extension bypass reads server source and secrets, then HMAC-signed node-serialize IIFE payload achieves RCE via admin import endpoint.