OpenECSC 2025

Web challenge writeups from OpenECSC 2025 - Python object/reference confusion, shared class attributes, hidden-field mass assignment, and admin config leakage.

0 categories 1 note

Notes

1 total

Polish Bar - shared class-attribute object confusion to admin config leak

A hidden /config form lets you copy a resolved attribute into an attacker-chosen config key. Point your alcohol_shelf at the shared _all_instances class list, call /empty so it dereferences element 0, and your config starts resolving preferred_beverage through the admin object that stores the flag.

web python fastapi jinja2 object-reference-confusion class-attribute +8