Lab 170 — PulseGuard — SnakeYAML Deserialization to H2 JDBC OOB Exfiltration

hackadvisor

Task: Spring Boot 3.2 monitoring platform with YAML import/export using SnakeYAML unsafe constructor. Solution: Exploit SnakeYAML !! tag to instantiate H2 JdbcConnection with INIT SQL that reads /root/flag.txt via FILE_READ, converts BLOB to VARCHAR via CSVWRITE/CSVREAD roundtrip, and exfiltrates via H2 CSVREAD HTTP GET to interaction server.