https://bokkapig.pages.dev/tags/esm.sh/Recent content in Esm.sh on bokkapigHugoen-gbSat, 18 Jul 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/bedside/Sat, 18 Jul 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/bedside/Bedside is a Debian 13 host running a clinic site on Apache 2.4.68 plus a second vhost, research.bedside.htb, whose file-upload portal advertises itself with an X-Powered-By: pdfminer.six header. Uploaded PDFs are picked up by a watcher and converted with pdf2txt.py running as datawrangler (uid 988) inside a data-wrangler Docker container, and the foothold is CVE-2025-64512 in that conversion: pdfminer.six resolves an unknown font /Encoding name through CMapDB, which joins the name onto its CMap directory and pickle.loads the result with a .pickle.gz suffix appended, so a hex-escaped absolute path in the PDF points the unpickler at a gzipped pickle uploaded through the same form. The container shares /datastore with the host and can reach an esm.sh dev server bound to :::3000 and running as developer (uid 1000); pivoting through it lands a shell as developer, who holds user.txt. Root is a machine-learning supply-chain bug: developer may run sudo /usr/bin/python3 /opt/trainer/bedside_trainer.py NOPASSWD, and that MONAI trainer resumes from the newest *.pt in /datastore/checkpoints via monai.handlers.CheckpointLoader, which unpickles the file with torch.load. Because /datastore/checkpoints is group-writable by dataops, datawrangler can plant a crafted .pt whose <strong>reduce</strong> calls os.system, giving arbitrary command execution as root. The real difficulty is not the pickle — it is that the trainer builds its model before it ever touches the checkpoint, and the hundreds of .txt files the PDF watcher floods into /datastore crash MONAI&rsquo;s LoadImaged transform first, so the checkpoint is never reached until /datastore/processed is cleared down to a single valid image.