tl;dr

• Leak JWT token through Race Condition.
• Leak authorization token via an open redirect.
• Chaining XSS & CSRF in the oauth pipeline to leak the Admin’s oauth access token.
• RCE via CVE-2023-33733.

tl;dr

• Zip Slip Vulnerability + YAML Deserialization Attack + Race Condition
• Unintended Solution: Upload symlink leading to arbitarary file reads