Lab 416 — SyncForge — Insecure Deserialization via Pickle Import

hackadvisor

Task: DevOps config management platform with import-delta API that deserializes raw pickle bytes when Content-Type is application/octet-stream. Decoy flags with prompt injection in HTML. Solution: Craft malicious pickle payload using __reduce__ to copy /flag.txt into the app's data directory, then download it via the /api/data/files endpoint.