An object in a cookie

Where did that object come from?

The target keeps your preferences in a prefs cookie — base64 of a Python pickled object — and un-pickles it on every request to /app/session. Set a normal one and it loads fine:

PREFS=$(python3 -c "import pickle,base64; print(base64.b64encode(pickle.dumps({'theme':'dark'})).decode())")
curl -s --cookie "prefs=$PREFS" http://127.0.0.1:8080/app/session

In the terminal

student@vulntech:~$ PREFS=$(python3 -c "import pickle,base64; print(base64.b64encode(pickle.dumps({'theme':'dark'})).decode())")
student@vulntech:~$ curl -s --cookie "prefs=$PREFS" http://127.0.0.1:8080/app/session
Loaded preferences: {'theme': 'dark'}

The problem: you control that cookie, and un-pickling untrusted data isn't just reading data — pickle can be made to run code as it rebuilds the object.