Sau
A Request Baskets instance is vulnerable to SSRF (CVE-2023-27163), which we use to reach a firewalled Maltrail service. Maltrail's unauthenticated command injection gives a reverse shell as puma, and a sudo-allowed systemctl status is escalated to root through its pager.