Lab 404 — MindVault — RCE via eval() in Search Filter Expressions

hackadvisor

Task: MindVault knowledge platform exposes a search 'Filter Expression' field that is server-side eval()'d as raw Python with no blacklist and no sandbox. Solution: use the test=1 API oracle to confirm eval (7*7=49), then __import__('os').popen('id') runs as root and open('/root/flag.txt').read() returns the flag; a decoy flag and prompt-injection text in HTML are ignored.