Webverselabs Parchive Challenge Command Injection

Scenario :

Parchive is a document-archiving SaaS founded in 2020 in Boston for mid-market law firms and audit shops, with seats starting at $89/month and a customer base of around 4,000 active reviewers. The bulk-export feature was rewritten last summer by a contractor who pushed back on the team’s request for a whitelist, arguing it would break power-user filenames; the compromise was a small “obvious junk” check on the archive name field. A client flagged some unexpected behaviour in the export endpoint during a routine review.

Solution :

As usual , we will navigate the application just like a normal user , understand different features , functionalities , then check Burp History to see the different requests that were made to the server .

After navigating the application , we find this Download button , looking at Burp’s History , this is the only POST request made to the server , and the only one containing a parameter we can tamper with .

I sent it to Repeater then tried some basic Command Injection payloads , injecting the first parameter resulted in an error .

But upon trying the same payload on the archive_name parameter , we dont get any errors :

Perfect we can try adding a different command , to see if we do actually have a command injection :

Perfect , we do have our commmand injection , now to read the flag , we don’t really know if spaces are blocked by default , for this we will use some basic bypasses , i already have this section on my methodology so i will just use it :

# Bypass Space : 

Check with New Line :  

\n : %0a ==> This is usually not blacklisted , we can check with this one , if it doesnt break anything , we probably have Command Injection .

===> Use $IFS : This is a known linux env variable .  
Ip=127.0.0.1%0a${IFS} 

So our payload will simply be :

%0acat${IFS}/flag.txt 

That was it for this challenge , see you in the next one :)