Jul 31, 2024, 11:10 AM
(This post was last modified: Jul 31, 2024, 11:10 AM by mazafaka555.)
(Jul 30, 2024, 08:08 PM)invisigoth Wrote: The challenge is named after fastjson.
The apk is using fastjson 1.1.52
Looking for vulnerabilities: https://security.snyk.io/package/maven/c...52.android
The first vulnerability is CVE-2022-25845
The details are https://jfrog.com/blog/cve-2022-25845-an...erability/
Follow the article and the json payload to enable the flag becomes obvious.
Great catch! That explain everything...