https://polymathmonkey.github.io/weblog/tags/privesc/index.htmlHugoen-usMon, 22 Jun 2026 14:02:00 +0200https://polymathmonkey.github.io/weblog/writeups/htbdevhub/index.htmlMon, 22 Jun 2026 12:39:00 +0200https://polymathmonkey.github.io/weblog/writeups/htbdevhub/index.htmlOverview Attribute Value OS Linux Difficulty Medium Category Web + Lateral Movement + PrivEsc Key CVEs CVE-2026-23744 Techniques RCE, API Abuse, Credential Exposure, WebSocket Manipulation DevHub is a medium-difficulty Linux machine centered around a developer toolchain: an MCPJam Inspector instance, a JupyterLab server, and an internal MCP operations service. The attack chain requires chaining three distinct vulnerabilities. An unauthenticated RCE in MCPJam Inspector, abuse of a JupyterLab API to achieve lateral movement, and credential exposure in an internal Flask service to escalate to root.