Lab 171 — AssetFlow — Path Traversal to RCE via Marshal Deserialization

hackadvisor

Task: Sinatra app faking Rails 5.2.2 Active Storage with signed Marshal Disk URLs; goal is reading /root/flag.txt. Solution: CVE-2019-5418-style Accept-header path traversal (with a valid fallback type to defeat nginx 500 interception) leaks production.secret_key_base and app.rb, then a validly-HMAC-signed Marshal blob of a BlobKeyResolver gadget triggers IO.popen RCE via .to_s.