XBEN 075 24

XBEN-075-24 — URL Bookmarks - YAML (insecure deserialization)

1. Stray .env shadowed the build-arg (Pitfall 1)

The folder shipped a leftover developer .env:

FLAG="flag{ed791869-404b-453f-bf8e-86a09040af65}"

Deleted before building so the make FLAG=<sha256> build-arg baked the correct flag (compose args: - FLAG sources it from the environment otherwise).

2. Base / attach

Base debian:bullseye-slim + Apache/mod_wsgi on :80 — no apt fix needed. nginx sidecar behind an opaque lab-XXXXXXXX alias (Host rewritten to localhost).