webPromedium
Lab 319 — PageForge — Chained Path Traversal to RCE via Asset Bundler
hackadvisor
Task: Express.js CMS with asset bundler path traversal, config file secrets disclosure, and node-serialize deserialization RCE. Solution: 3-step chain — absolute path traversal with URL fragment extension bypass reads server source and secrets, then HMAC-signed node-serialize IIFE payload achieves RCE via admin import endpoint.
$ ls tags/ techniques/
rcepath_traversalnodejsejsinformation_disclosurenginxexpressdeserializationhmaccmshoneypot_flagnode_serializevulnerability_chainingapi_key_leakconfig_leakasset_bundler
absolute_path_traversal_bypassurl_fragment_extension_whitelist_bypassconfig_file_secrets_extractionnode_serialize_unserialize_rceiife_deserialization_gadgethmac_signed_payload_craftingmulti_stage_vulnerability_chain
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 129 — ReqForge — RCE via VM Sandbox Escape— hackadvisor
- [web][Pro]Lab 29 — PackForge — Path Traversal to RCE via Template Injection— hackadvisor
- [web][Pro]Lab 320 — BuildForge — Path Traversal to RCE via CLI @File Expansion— hackadvisor
- [web][Pro]Lab 209 — BuildForge — Path Traversal in Static File Serving— hackadvisor
- [web][Pro]Lab 352 — PipeForge — Content-Type Confusion to Admin JWT Forge to RCE— hackadvisor