This is the final showdown of the web track. The full Ravens panel does not fall to one bug but to a chain of three: you start as a guest and link an id leak, a predictable session, and a template injection to reach the master key that brings the panel down.
The Ravens panel is a multi-page app: Panel, Members, My session and the Report tool. You begin as a guest. The Members page leaks any member key hint, the My-session page reveals the predictable session format, and the admin Report tool renders a template against a context holding the master key. No single step is enough.
Chain the three bugs to extract the master key from the report tool.
You extracted the master key and took down the Ravens panel.
Why the solution worked
Each bug alone is limited, but chaining them is a full compromise: the id leak gave the hint, the hint plus the predictable session format forged an admin session, and the admin session opened a template-injectable tool that revealed the key. This is how real attacks work — a chain, not a single flaw — and defence breaks the chain at every link: ownership checks on members, random signed sessions, and templates never built from user input.
The root cause
Three roots combine: missing object authorization on members, a predictably-derived session, and rendering a user template against a sensitive context. Each is a link in the chain.
How the code is fixed
Break the chain at every link: object authorization, random signed sessions, and fixed templates never built from user input.
Vulnerable code
app.post('/member', (req, res) => res.json(members[req.body.id])); // IDOR
const role = session.split(':')[0]; // predictable session
res.send(render(req.body.template, { config: { master } })); // SSTI
Safe code
app.post('/member', requireOwner, (req, res) => res.json(ownRecord(req.user))); // ownership
const { role } = verifySigned(session); // random, signed
res.send(renderFixedTemplate({ name: req.user.name })); // no user template
Impact in the real world
Vulnerability chains are what turn medium issues into full admin-panel compromise in the real world; the biggest bounty reports are usually chains, not a single bug.
How defenders detect it
Defenders think in chains, not single bugs: enforce ownership checks and random signed sessions, forbid user-supplied templates, and alert on a path from an id leak to privilege escalation to an admin tool.
