Security Research on 思安录 | Thinking's Security Notes

0day Hunting the Day After xAI Open-Sourced grok-build (Part 4): ptyctl Test Server's Zero-Auth CORS and Cross-Origin RCE

Thinking — Mon, 20 Jul 2026 00:00:00 +0000

0day Hunting the Day After xAI Open-Sourced grok-build (Part 3): Grok-Build-CLI's folder-trust Blind Spot and the Zero-Prompt RCE

Thinking — Sat, 18 Jul 2026 00:00:00 +0000

0day Hunting the Day After xAI Open-Sourced grok-build (Part 1): The cargo check RCE Chain in Grok-Build-CLI

Thinking — Thu, 16 Jul 2026 00:00:00 +0000

0day Hunting the Day After xAI Open-Sourced grok-build (Part 2): The bypassPermissions RCE in Grok-Build-CLI and Claude Code CLI

Thinking — Thu, 16 Jul 2026 00:00:00 +0000

Grok CLI Whole-Repo Upload Reverse Analysis: How a Single Prompt Ships Your .env to the Cloud

Thinking — Wed, 15 Jul 2026 00:00:00 +0000

Telegram Desktop Local Session Reuse: a Reproduction That Should Not Have Happened

Thinking — Wed, 15 Jul 2026 00:00:00 +0000

The reproduction result exceeded what I understood to be possible. Telegram’s device authentication — phone verification, SMS code, 2FA password — seemed, to me, well-designed and complete. But when the tdata directory was copied to another Mac and the client launched, the login screen never appeared. This was not 2FA being cracked. The entire reuse path never entered a stage where credentials were requested.

Trust Wallet Extension Backdoor: v2.68 Malicious Code Injection Analysis

Thinking — Fri, 26 Dec 2025 00:00:00 +0000

CVE-2025-53770 SharePoint WebPart Injection Deserialization RCE: Active Exploitation Before Patch Day

Thinking — Tue, 15 Jul 2025 00:00:00 +0000

SharePoint treats WebPart rendering as “trusted internal”, but the ToolPane.aspx endpoint accepts unauthenticated POST — attackers construct a malicious WebPart payload that triggers a .NET deserialization gadget chain, executing arbitrary commands on the SharePoint Server without authentication, and Microsoft has confirmed it is being exploited in the wild.

A Popular Solana Bot on GitHub Was a Wallet Thief: Supply Chain Attack Analysis

Thinking — Thu, 03 Jul 2025 00:00:00 +0000

CVE-2025-44148 MailEnable Webmail Reflected XSS: Unsanitized state Parameter in failure.aspx

Thinking — Sun, 15 Jun 2025 00:00:00 +0000

MailEnable Webmail’s failure.aspx writes the state parameter verbatim into the HTML when displaying the error page — attackers craft a state=<script>...</script> URL, the victim clicks, MailEnable writes it without sanitization, triggering reflected XSS — stealing sessions, cookies, launching phishing.

Osiris Malicious Browser Extension Analysis: Download Link Hijacking Disguised as a Security Tool

Thinking — Wed, 28 May 2025 00:00:00 +0000

CVE-2025-32433 Erlang/OTP SSH Pre-Auth RCE: Session Channel Eats Erlang Code

Thinking — Thu, 15 May 2025 00:00:00 +0000

Erlang/OTP’s SSH server hands client-sent “command strings” on session channels directly to the Erlang VM to parse and execute — after completing the SSH handshake, attackers send not a normal shell command but an Erlang expression (e.g. os:cmd("whoami")); OTP SSH executes it as code before authentication.

CVE-2025-55184 React Server Components Infinite Loop DoS: A Single Payload Locks CPU

Thinking — Thu, 15 May 2025 00:00:00 +0000

React Server Components hand “client-sent request parameters” to the deserialization parser — attackers send a specially crafted payload, triggering the RSC parser to enter an infinite loop during deserialization, immediately consuming 100% CPU, and putting the entire service in an unavailable state.

Explore CMS v1.1 Reflected XSS: How a Community CMS's UserID Field Became the Attack Entry Point

Thinking — Thu, 15 May 2025 00:00:00 +0000

The user/login.php and admin/login.php endpoints in Explore CMS v1.1 perform zero sanitization or validation on the UserID field — an attacker can trigger reflected XSS with the simplest <script>alert(1)</script> payload, stealing sessions, cookies, and email content. This is especially dangerous for community CMS users.

CVE-2025-32395 Vite Dev Server Path Traversal: # Character Bypass of server.fs.deny

Thinking — Tue, 15 Apr 2025 00:00:00 +0000

Vite Dev Server’s server.fs.deny middleware uses regex matching on the URL to refuse access to files outside the project directory — but the # character per RFC 9112/9113 should only be used as a URL fragment, while Node.js by default allows # in the path. Attackers use this difference to craft /src/safe.txt#/../../../unsafe.txt, so fs.deny sees /src/safe.txt (in whitelist) but the filesystem actually accesses unsafe.txt (outside whitelist).

CVE-2025-4123 Grafana Full-Read SSRF + Account Takeover: Open Redirect + CSPT + Client-Side Traversal Chain

Thinking — Tue, 15 Apr 2025 00:00:00 +0000

Grafana’s staticHandler returns 302 when a directory is missing the trailing / — attackers use \attacker.com/? so FileSystem.Open parses it as a legitimate directory, but http.Redirect outputs it as an external URL; combined with render endpoint and plugin-app explore client-side path traversal, the three-stage chain delivers Account Takeover.

CVE-2025-52287 WSUS Deserialization to RCE: Four-Stage Exploitation via SimpleAuth Cookie Chain

Thinking — Tue, 15 Apr 2025 00:00:00 +0000

WSUS treats the SimpleAuth plugin’s authentication Cookie as “verified trust”, but the chain that generates the Cookie has no strict deserialization protection — attackers use a 4-stage attack (obtain session ID, get auth Cookie, use Cookie to trigger SimpleAuth, inject malicious .NET deserialization payload) to gain RCE on the patch distribution center.

CVE-2025-56386 Notepad++ DLL Hijacking: v8.8.3 DLL Search Order and CWD Fatal Combination

Thinking — Tue, 15 Apr 2025 00:00:00 +0000

Notepad++ uses Windows’ default DLL search order (including CWD) when loading DLLs, but does not use SetDefaultDllDirectories with LOAD_LIBRARY_SEARCH to limit safe paths — attackers place a malicious same-named DLL in the CWD where the user opens a malicious document, and Notepad++ preferentially loads the CWD’s malicious DLL on startup, completing RCE under user privileges.

CVE-2025-30406 CentreStack Deserialization to RCE: Hard-coded Machine Key + ASP.NET ViewState Exploitation

Thinking — Tue, 01 Apr 2025 00:00:00 +0000

CentreStack hard-codes ASP.NET’s MachineKey (the validation key for ViewState signing) into the product configuration — attackers only need to extract this key from the product source or binary, use ysoserial to craft a malicious ViewState, and trigger ASP.NET-side deserialization to execute arbitrary commands; the entire attack chain requires no authentication.

ReachMe.io Vulnerability: Saying Hi to CZ on a Budget

Thinking — Fri, 28 Mar 2025 00:00:00 +0000

Yesterday, while I was still sorting through APT attack materials, Brother Shan (@im23pds) suddenly rushed over to my desk, excited: “Thinking, I found an interesting project that CZ is using heavily — maybe we can say Hi to CZ for zero cost.” We quickly brainstormed several potential vulnerability points:

Hijacking CZ’s ReachMe account;
Changing CZ’s ReachMe settings;
Messaging CZ for free, bypassing the 1 BNB fee to send him a message.

About 10 minutes later, we discovered a vulnerability that allowed sending messages to any user on ReachMe.io at low cost. We immediately contacted the project team with detailed vulnerability verification. The project team quickly fixed the vulnerability and reached back out to us for retesting. Kudos to the ReachMe team for taking security seriously!

Additionally, the SlowMist Security Team was honoured to receive thanks from both CZ and the ReachMe project team.

CVE-2025-29927 Next.js Authentication Bypass: x-middleware-subrequest Recursion Depth Evasion

Thinking — Sat, 22 Mar 2025 00:00:00 +0000

Next.js uses the x-middleware-subrequest header with recursion depth (MAX_RECURSION_DEPTH=5) to decide “is the current request a legitimate subrequest?” — attackers only need to put 5 repeated middleware paths in the header to trigger the “internal subrequest” judgment and completely skip middleware’s authentication, authorization and CSP checks.

CVE-2025-24813 Apache Tomcat Path Equivalence + Persistent Session RCE: Partial PUT and Default Servlet Converging

Thinking — Sat, 15 Mar 2025 00:00:00 +0000

Tomcat’s default servlet serves as a “static file server” with both read and write capability exposed — the attacker uses a Content-Range partial PUT to write a JSP payload into Tomcat’s work directory, then a GET request makes default servlet compile and execute it as JSP. The whole RCE chain completes on the public internet.

CVE-2025-27415 Nuxt.js Cache Poisoning DoS: Newline Bypass on Route Regex

Thinking — Sat, 15 Mar 2025 00:00:00 +0000

Nuxt.js’s Nitro route regex treats newline (\n) as a legal character — the attacker stuffs newlines and spaces into the URL, bypasses the route regex’s key extraction, and makes Nitro write an empty key into the cache. Repeated requests grow the cache without bound and exhaust server memory for DoS.

CVE-2025-5777 Citrix NetScaler Memory Overread: From Reflection to Pre-Auth Memory Leak

Thinking — Sat, 15 Mar 2025 00:00:00 +0000

Citrix NetScaler reflects the user-supplied login field verbatim into the <InitialValue> tag of the login response XML — the attacker weaponizes this reflection point by sending an oversized login string, which triggers a memory overread in the NetScaler process and returns adjacent memory as part of the response, leaking session tokens, configuration, credentials, and other sensitive data.

LinkedIn Recruitment Phishing Analysis: A Targeted Attack Against Blockchain Engineers

Thinking — Sat, 15 Mar 2025 00:00:00 +0000

CVE-2025-21756 Linux Kernel vsock UAF: Shortest Path from Socket Subsystem to Root

Thinking — Fri, 28 Feb 2025 00:00:00 +0000

Linux kernel’s vsock_diag_dump iterates AF_VSOCK sockets but the release order between the transport pointer (sk) and the vsock pointer (vsk) is misaligned — the attacker closes one side to leave the other dangling, and the next iteration lands on freed memory, escaping to the kernel control flow.

Lazarus Group APT Attack on Cryptocurrency Exchanges: IOC & TTP Disclosure

Thinking — Sun, 23 Feb 2025 00:00:00 +0000

Cybersecurity is a war of endurance. This article is co-authored by me (Thinking) and 23pds.

CVE-2024-12877 GiveWP PHP Object Injection: When unserialize Meets Magic Methods

Thinking — Sat, 15 Feb 2025 00:00:00 +0000

GiveWP calls unserialize() on user-controlled fields, and PHP automatically fires magic methods when deserializing. An attacker only needs to ship an object with the right magic method — PHP itself will run the attacker’s code, bypassing the early is_serialized regex that only recognized array and object types.

CVE-2025-0133 GlobalProtect Gateway Reflected XSS: credential theft at the VPN portal

Thinking — Sat, 15 Feb 2025 00:00:00 +0000

The Palo Alto GlobalProtect VPN gateway login page does not filter user input. An attacker injects JavaScript via a malicious URL to steal user credentials.

CVE-2025-11001 7-Zip ZIP Parsing Directory Traversal to RCE: Symlink Converging With the Extraction Path

Thinking — Sat, 15 Feb 2025 00:00:00 +0000

7-Zip treats symlink entries inside a ZIP as ordinary directory entries — the attacker crafts a three-layer structure of “directory + symlink + malicious file”, the symlink points to a sensitive system path, and when the victim extracts, the malicious file lands wherever the symlink points.

CVE-2025-21298 Windows OLE RCE: Plus-Offset Triggering Use-After-Free in CStdStubBuffer

Thinking — Wed, 22 Jan 2025 00:00:00 +0000

Windows OLE delegates object reference counting to ole32!CStdStubBuffer_Disconnect — the attacker crafts OLE references in an RTF document so the reference count jumps via plus-offset to a specific value, triggering premature object release; when the COPE framework later calls a virtual function on the freed object, the result is UAF.

CVE-2024-12877 GiveWP PHP Object Injection: unserialize vs. Regex, a Futile Fight

Thinking — Wed, 15 Jan 2025 00:00:00 +0000

GiveWP calls unserialize() on user input and tries to gate it with a regex “is this serialized?” check. But as long as the underlying call is unserialize, regex is decoration. Once the attacker slips past the regex, magic methods like __wakeup() take over execution flow — and the chain rolls from injection to RCE.

CVE-2025-0108 PAN-OS Authentication Bypass: Palo Alto firewall compromised again

Thinking — Wed, 15 Jan 2025 00:00:00 +0000

Specific paths of the Palo Alto PAN-OS management interface do not enforce authentication. An attacker bypasses auth to access management functions directly, and combined with command injection, achieves unauthenticated RCE.

CVE-2025-0282 Ivanti Connect Secure Pre-Auth Stack Overflow RCE: Buffer Overflow on the VPN Gateway

Thinking — Wed, 15 Jan 2025 00:00:00 +0000

Ivanti Connect Secure exposes the pre-authentication welcome.cgi endpoint directly to the internet without any length check on request parameters — an attacker fills the stack buffer with 500 A’s, overwrites the return address with system(), and gets arbitrary command execution on the VPN gateway without any credentials.

CVE-2024-10793 WP Activity Log: Stored XSS to RCE in the Audit Page

Thinking — Wed, 25 Dec 2024 00:00:00 +0000

WP Activity Log writes user behavior into the log page with zero sanitization. Once the stored XSS fires, the attacker grabs the admin nonce and uploads a PHP webshell — the entire chain goes from a single log entry all the way to RCE.

CVE-2024-10793 WP Activity Log Stored XSS to RCE: Unsanitized Writes to the Admin Render Plane

Thinking — Thu, 19 Dec 2024 00:00:00 +0000

WP Activity Log treats the admin’s “activity log” panel as a trusted render plane, but leaves the write path unsanitized — an attacker injects HTML through admin-ajax, and any admin who opens the panel is compromised. With stolen nonce credentials plus a plugin upload, the chain from anonymous POST to RCE is complete.

Three npm Vulnerabilities in lunary-ai: SAML XSS, IDOR, and Privilege Escalation on the Same Trust Chain

Thinking — Thu, 19 Dec 2024 00:00:00 +0000

The same npm package lunary-ai/lunary (before 1.6.7) exposed three CVEs at once — Stored XSS in SAML metadata, IDOR in the PATCH score endpoint, and Privilege Escalation in the PATCH model endpoint. All three trace to the same root: the boundary between authentication and authorization, the one that’s so easy to overlook.

CVE-2024-52875 Kerio Control CRLF Injection to 1-click RCE: silent firewall takeover

Thinking — Mon, 16 Dec 2024 00:00:00 +0000

The Kerio Control firewall’s web admin interface does not filter CRLF characters. An attacker crafts a malicious link, lures the admin to click, and gets a shell on the firewall with 1-click.

CVE-2024-46982 Next.js Cache Poisoning: silent hijacking of non-dynamic SSR pages

Thinking — Fri, 15 Nov 2024 00:00:00 +0000

Next.js non-dynamic SSR pages do not isolate user-specific data at the cache layer. An attacker poisons the cache with a malicious Host header, and all subsequent users receive the poisoned response.

CVE-2024-9264 Grafana DuckDB SQLi to RCE: authenticated database piercing

Thinking — Tue, 15 Oct 2024 00:00:00 +0000

Grafana 11.0.0-11.2.1’s SQL query interface allows authenticated users to inject DuckDB commands, read arbitrary files, and under specific configurations, achieve RCE directly.

CVE-2024-5420 SEH UTN Server XSS: cross-site scripting in USB device management interface

Thinking — Thu, 15 Aug 2024 00:00:00 +0000

The SEH UTN Server’s USB device management web interface does not filter user input. An attacker crafts a malicious URL to inject JavaScript and steal the admin session.

CVE-2024-41992 Arcadyan FMIMG51AX000J RCE: ISP router supply chain bug

Thinking — Tue, 06 Aug 2024 00:00:00 +0000

A RCE in the Arcadyan FMIMG51AX000J router firmware (used in WiFi Alliance certified devices), CVSS 9.8, affects a large number of ISP-deployed home gateway devices globally.

CVE-2024-27956 WP Automatic SQL Injection: from 9.9 plugin bug to admin account takeover

Thinking — Mon, 15 Jul 2024 00:00:00 +0000

The WordPress valvePress/Automatic plugin does not filter %0a or null bytes in the auth parameter. An attacker bypasses auth, runs SQL injection through the q parameter, and eventually creates an eviladmin account to take over the site.

CVE-2024-38475 Apache HTTPD mod_rewrite path traversal: from BlackHat 2024 to RCE

Thinking — Mon, 15 Jul 2024 00:00:00 +0000

A path-matching logic flaw in Apache HTTPD mod_rewrite, CVSS 9.1, disclosed at BlackHat 2024. An attacker crafts a special URL to bypass rewrite rules and access restricted files.

CVE-2024-40725 Apache HTTPD HTTP request smuggling: Content-Length parsing inconsistency

Thinking — Mon, 15 Jul 2024 00:00:00 +0000

Apache HTTPD processes Content-Length headers with special characters differently from the proxy/backend, letting an attacker craft a special request to perform HTTP request smuggling.

CVE-2024-4956 Sonatype Nexus OSS Path Traversal: from artifact repository to arbitrary file read

Thinking — Mon, 15 Jul 2024 00:00:00 +0000

Sonatype Nexus Repository OSS does not sufficiently filter paths, letting an attacker craft a special URL to read arbitrary files on the server without authentication.

CVE-2024-38094 Microsoft SharePoint RCE: unauthenticated remote code execution

Thinking — Tue, 09 Jul 2024 00:00:00 +0000

A remote code execution vulnerability in Microsoft SharePoint Server, CVSS 6.3, lets an attacker bypass authentication via a crafted request and execute arbitrary code, affecting a large number of enterprise SharePoint deployments.

CVE-2023-7137 Client Details System 1.0 SQL Injection: classic boolean-based bug in uemail

Thinking — Thu, 04 Jul 2024 00:00:00 +0000

Client Details System 1.0 concatenates the uemail parameter directly into a SQL query. An attacker uses the classic OR 1=1 to bypass login, then hands the request to SQLmap to dump the entire database.

Fake Aggr Chrome Extension Crypto Theft Analysis: Cookie Stealing and Wash Trading

Thinking — Fri, 31 May 2024 00:00:00 +0000

CVE-2024-7954 Prote_plume Plugin RCE: from open-source security tool to unauthenticated RCE

Thinking — Mon, 20 May 2024 00:00:00 +0000

The Prote_plume security scanning plugin itself contains an unauthenticated RCE, CVSS 9.8. An attacker can execute arbitrary commands on the server with a simple request.

CVE-2023-50164 Apache Struts File Upload Path RCE: A Classic Bug in a Classic Framework

Thinking — Wed, 15 May 2024 00:00:00 +0000

Apache Struts’ file upload parameter handling allows path manipulation — an attacker uploads a file to an arbitrary location and triggers RCE via OGNL injection.

CVE-2024-24919 Check Point VPN Arbitrary File Read: The Admin Plane on the Public Internet

Thinking — Wed, 15 May 2024 00:00:00 +0000

Check Point’s SSL Network Extender exposes /clients/MyCRL on the public internet without authentication — a single POST reads /etc/passwd. Combined with Censys and nuclei templates, this “admin plane trusts by default” gap is being harvested at scale.

CVE-2024-32002 Git submodule + symlink RCE: arbitrary code execution via git clone –recursive

Thinking — Wed, 15 May 2024 00:00:00 +0000

When Git performs a recursive clone it executes the submodule’s post-checkout hook. An attacker crafting a malicious repository with a symlink achieves RCE at the clone stage — no exploit shipping required.

CVE-2023-46943 JWT Token Verification Bypass: from missing signature checks to identity spoofing

Thinking — Wed, 01 May 2024 00:00:00 +0000

JWT libraries do not enforce signature checks by default — developers have to opt in. An attacker changes alg to none or swaps the key to bypass authentication directly.

CVE-2024-3400 Palo Alto GlobalProtect Command Injection: a CVSS 10.0 critical chain attack

Thinking — Fri, 12 Apr 2024 00:00:00 +0000

The Palo Alto GlobalProtect command injection scored a perfect 10.0 on CVSS. An unauthenticated attacker sends a crafted request to run arbitrary commands on the firewall and writes a cron job for persistence.

CVE-2024-4439 WordPress Core Unauthenticated Stored XSS: Block Editor rendering chain

Thinking — Tue, 09 Apr 2024 00:00:00 +0000

WordPress Core versions prior to 6.5 do not sufficiently filter content when rendering in the Block Editor. An attacker-crafted post can trigger an unauthenticated stored XSS.

CVE-2024-23724 Ghost CMS SVG Stored XSS: from avatar upload to Owner takeover

Thinking — Fri, 22 Mar 2024 00:00:00 +0000

Ghost CMS lets users upload SVG files as avatars without sanitization. An attacker uses a JavaScript-bearing SVG to hijack the Owner’s session and escalate from Contributor to Admin to Owner.

CVE-2024-29291 Laravel database credential leakage: the PDOException logging mistake

Thinking — Fri, 22 Mar 2024 00:00:00 +0000

When a PDO exception is thrown, Laravel writes the full database connection information, including the password, to the log. Anyone who gets the log can connect to the database with the leaked DSN, user, and password.

CVE-2023-7028 GitLab Account Takeover: dual-recipient password reset

Thinking — Thu, 14 Mar 2024 00:00:00 +0000

GitLab’s password reset flow lets a single request deliver mail to multiple addresses. The attacker appends their own inbox to the victim’s reset request and takes over the account.

CVE-2023-6553 WordPress Backup Migration Unauthenticated RCE: PHP filter chain weaponized

Thinking — Thu, 29 Feb 2024 00:00:00 +0000

The WordPress Backup Migration plugin’s includes/backup-heart.php endpoint mishandles user input. An attacker uses a PHP filter chain to write a shell to disk and take over the server without authentication.

CVE-2023-51766 SMTP Smuggling Recap: Where Exim's End-of-Data Interpretation Breaks

Thinking — Thu, 15 Feb 2024 00:00:00 +0000

Exim before 4.97.1 delegates the decision of “when DATA ends” to whatever bytes the SMTP client carries — effectively outsourcing the trust boundary to the peer. As long as the outbound passes <LF>.<CR><LF> and the inbound accepts it as the end marker, attackers can smuggle arbitrary SMTP commands into the same session.

CVE-2023-31893 Vivo Play IPTV DNS Recursion DoS: amplification attack via carrier firmware

Thinking — Thu, 08 Feb 2024 00:00:00 +0000

Telefônica Brasil’s Vivo Play IPTV device exposes DNS recursion to the public internet. Attackers can use DDoS-Ripper-style amplification tools to knock it offline.

CVE-2023-4357 Chrome XEE on WebBrowsers: from XML external entity to arbitrary file read

Thinking — Mon, 15 Jan 2024 00:00:00 +0000

The Chrome browser’s XML parser does not disable external entity loading when processing user-controlled XML. An attacker crafts malicious XML to read local files.

CVE-2024-22144 WordPress GOTMLS Plugin Code Injection: a 200k-install string concatenation bug

Thinking — Mon, 15 Jan 2024 00:00:00 +0000

The WordPress GOTMLS plugin (200k+ active installs) does not parameterize user input. An attacker can run arbitrary PHP on the server through simple string concatenation.

CVE-2024-34351 Next.js SSRF: Server Actions and the Host Header's Quiet Collusion

Thinking — Mon, 15 Jan 2024 00:00:00 +0000

Next.js’ Server Actions trust the user-controlled Host header during a redirect flow. An apparently innocent internal fetch exposes internal HTTP services to any external attacker — and a Flask pivot upgrades the SSRF from a ping to a full read.

node-serialize Deserialization RCE: An Underestimated Trust Chain in a Node.js Library

Thinking — Mon, 15 Jan 2024 00:00:00 +0000

The tiny serialization library node-serialize, last released as 0.0.4, left one backdoor in its unserialize() function — any JSON field whose value starts with _$$ND_FUNC$$_ is fed straight into eval(). The result is arbitrary Node.js code execution.

CVE-2023-50164 Apache Struts: Path Traversal in File Upload to RCE

Thinking — Fri, 15 Dec 2023 00:00:00 +0000

Apache Struts’ ActionSupport does not strictly validate upload paths, so changing a single multipart field name lets attackers drop a webshell straight into Tomcat webapps — yet another round of the old path-traversal-to-RCE story hitting Struts in 2023.

CVE-2023-51766 SMTP Smuggling: Sneaking Forged Mail Past SPF and DMARC

Thinking — Fri, 15 Dec 2023 00:00:00 +0000

The outbound SMTP server treats <LF>.<CR><LF> as ordinary body content; the inbound server treats it as the DATA terminator. That interpretation gap lets an attacker smuggle arbitrary SMTP commands past the recipient, bypassing SPF/DKIM/DMARC and forging mail from gmx.net, web.de, Exchange Online and beyond.

CVE-2023-49103 + CVE-2023-49105 ownCloud Info Leak + Privilege Escalation to RCE Chain: How PHPinfo Exposure Became the Attacker's Key

Thinking — Wed, 15 Nov 2023 00:00:00 +0000

ownCloud exposes the full PHPinfo page on a few endpoints such as /settings/phpinfo (CVSS 10), and at the same time the WebDAV URL signature defaults to an empty string when the user has not configured a signing key, allowing the attacker to forge a request for any username (CVSS 9.8) — the two CVEs combine into a complete attack chain: PHPinfo exposure gives away ImageMagick / GraphQL information → WebDAV signature forgery lets the attacker impersonate any user → old ImageMagick vulnerability triggers RCE.

CVE-2023-43341 Evolution CMS Reflected XSS: Reflected Attack Surface in the Admin Panel

Thinking — Fri, 15 Sep 2023 00:00:00 +0000

Evolution CMS lacks escape on multiple parameters in the admin panel — URLs crafted by attackers directly trigger XSS when an admin clicks them, giving full backend control.

CVE-2023-38831 WinRAR Spoof: 0-Click Attack via Archive File Masquerading

Thinking — Wed, 23 Aug 2023 00:00:00 +0000

WinRAR’s extraction logic has a hidden behavior — when an archive contains both a “same-named directory” and a “same-named executable file,” WinRAR prefers to extract the executable file to the current directory and auto-execute it. An attacker’s carefully crafted “looks-like-a-safe-image” turns out to be an executable.

CVE-2023-38286 Spring Boot Admin SSTI: Thymeleaf Expression Injection to RCE

Thinking — Tue, 22 Aug 2023 00:00:00 +0000

Spring Boot Admin’s UI view layer uses Thymeleaf — but Thymeleaf prior to 3.1.0’s view name resolution allows attackers to inject SpEL expressions via request headers, and the template engine executes arbitrary Java code when parsing the view path.

CVE-2023-4357 Chrome LibXSLT XEE: The XML External Entity Surface Browsers Forgot

Thinking — Tue, 22 Aug 2023 00:00:00 +0000

WebKit-based browsers like Chrome ship LibXSLT as their default XSL engine, but its document() function still allows loading external entities — so file:// resources outside the sandbox quietly get read. This is a browser-side XEE writeup built around a consistency gap.

CVE-2023-3519 Citrix NetScaler RCE: Unauthenticated Remote Command Execution

Thinking — Wed, 19 Jul 2023 00:00:00 +0000

Citrix NetScaler is the core entry point for enterprise VPN and remote work — CVE-2023-3519 lets anyone get a root shell with a single HTTP request.

CVE-2023-25157 GeoServer SQLi: Property Injection in OGC API Filters

Thinking — Sat, 22 Apr 2023 00:00:00 +0000

GeoServer’s WFS/WMS GetFeature requests accept OGC Filter parameters — but the property name field has zero SQL escape, and attackers can splice arbitrary SQL subqueries straight into it to harvest the entire database.

CVE-2023-24488 QR Code Generator XSS: A Stored XSS on code-projects.org

Thinking — Tue, 21 Feb 2023 00:00:00 +0000

The open-source QR Code Generator on code-projects.org concatenates user input directly into an href link when generating the QR Code preview — write a javascript:alert(1) in, and the moment the QR Code is scanned, XSS fires.

CVE-2022-48110 CKEditor 5 XSS: Sanitizer Gaps in data: URL Schemes

Thinking — Sat, 10 Dec 2022 00:00:00 +0000

After CKEditor 5 switched to the model + view two-layer architecture, the XSS risk should have been eliminated — but the sanitizer still missed URL forms like the data: protocol header during model→view deserialization.

CVE-2022-41082 Microsoft Exchange RCE: The SSRF Pre-Stage of ProxyNotShell

Thinking — Tue, 04 Oct 2022 00:00:00 +0000

The SSRF pre-stage of the ProxyNotShell attack chain — when CVE-2022-41082 exists alone, it only lets the attacker hit Exchange’s internal PowerShell Remoting, but combined with CVE-2022-41040 it becomes full-network RCE.

Celer Network cBridge Cross-Chain Bridge Incident Analysis: BGP Hijacking Attack

Thinking — Sat, 20 Aug 2022 00:00:00 +0000

Solana Blockchain Mass Theft Analysis: Slope Wallet Sentry Leaks Mnemonic Phrases

Thinking — Thu, 04 Aug 2022 00:00:00 +0000

MetaMask Browser Extension Wallet demonic Vulnerability Analysis

Thinking — Fri, 17 Jun 2022 00:00:00 +0000

On 16 June 2022, MetaMask (MM) officially disclosed a security issue discovered by a white-hat researcher, dubbed the demonic vulnerability. The vulnerability affects versions < 10.11.3. Given MM’s large user base and the number of wallets developed based on MM, the impact is significant — MM generously awarded the white-hat researcher a $50,000 bounty. After the team synced me on this vulnerability, I began analysing and reproducing it.

MetaMask Clickjacking Vulnerability Analysis: iframe Hijacking and Phishing Whitelist Bypass

Thinking — Tue, 14 Jun 2022 00:00:00 +0000

On 3 June 2022, MetaMask (MM) publicly disclosed a severe Clickjacking vulnerability discovered by a white-hat researcher. The impact: when a user’s MM extension wallet is unlocked and they visit a malicious site, the site can use an iframe tag to embed the unlocked MM wallet page, hide it, and then guide the user to click on what appears to be the website — while the actual interaction happens on the unlocked MM page — thereby stealing the user’s cryptocurrency or NFTs. Given MM’s large user base and the number of projects that fork MetaMask, we immediately began reproducing the vulnerability and searching for its impact on other forked projects after MM’s disclosure.

The SlowMist Security Team then notified affected project teams as much as possible and guided them through remediation. We are now publishing this Clickjacking vulnerability analysis to help future projects avoid the same pitfall.

Discord DM Phishing Technique Analysis

Thinking — Tue, 17 May 2022 00:00:00 +0000

Sky-High Fee Analysis: ethjs-util Floating-Point Data Processing Flaw

Thinking — Wed, 29 Sep 2021 00:00:00 +0000

CVE-2021-39316 DZS Zoomsounds: Unauthenticated Arbitrary File Read

Thinking — Sun, 15 Aug 2021 00:00:00 +0000

The DZS Zoomsounds plugin has a download endpoint that reads whatever path the client passes, with no permission check — crafting ../../../wp-config.php is enough to read the database password.

CVE-2021-34527 PrintNightmare: A SYSTEM-Level DLL Loading Trap in Windows Print Spooler

Thinking — Tue, 06 Jul 2021 00:00:00 +0000

A DLL-loading control gap in the Windows Print Spooler service — a single crafted SMB share is enough to coerce the system into loading an attacker-supplied driver DLL and handing the attacker SYSTEM-level command execution.

CVE-2021-3129 Laravel Ignition RCE: Phar Deserialization Path in Debug Mode

Thinking — Tue, 02 Feb 2021 00:00:00 +0000

Laravel’s Ignition error page gives developers a “click to fix” button — but the underlying logic is phar deserialization. If an attacker can write a PHP-serialized payload into a file Laravel treats as a log, they get control of the entire process.

CVE-2020-10770 Keycloak SSRF: One OIDC Parameter Exposes Internal Servers

Thinking — Wed, 18 Nov 2020 00:00:00 +0000

A single OIDC parameter — request_uri — is enough to turn Keycloak into a proxy. With no proper validation, any URL the attacker controls becomes a request Keycloak will fire for them.

CVE-2020-5902 F5 BIG-IP TMUI RCE: From File Read to Root Command Execution

Thinking — Wed, 01 Jul 2020 00:00:00 +0000

F5 BIG-IP’s TMUI hides an entire layer of “undocumented interfaces” — CVE-2020-5902 exposed the cost of that layer: an unauthenticated remote attacker directly gets a root shell.

CVE-2020-981 CKEditor 4 XSS: Sanitizer Boundaries in Rich Text Editors

Thinking — Tue, 12 May 2020 00:00:00 +0000

CKEditor 4’s sanitizer has a gap in handling certain HTML tag-attribute combinations prior to v4.13 — a single crafted HTML snippet is enough to inject Stored XSS into every application that uses CKEditor 4.

CVE-2020-0601 CurveBall: ECC Elliptic Curve Spoofing in Windows CryptoAPI

Thinking — Tue, 14 Jan 2020 00:00:00 +0000

CurveBall lets attackers forge a certificate that bypasses the entire Windows trust chain — all it takes is computing a pair of “isomorphic but different” elliptic curve keys, and any certificate they sign will be trusted.

CVE-2019-15107 Webmin Unauthenticated RCE: command injection in password_change.cgi

Thinking — Wed, 28 Aug 2019 00:00:00 +0000

Webmin’s password_change.cgi does not filter the old parameter when passwd_mode=2 is set, letting unauthenticated attackers inject a pipe into the unix_crypt shell path and execute arbitrary commands.

Code Audit: Z-BlogPHP 1.5.1 Zero GetShell Vulnerability Analysis

Thinking — Thu, 19 Apr 2018 00:00:00 +0000

Code Audit: YXCMS 1.4.6 Vulnerability Collection

Thinking — Thu, 08 Feb 2018 00:00:00 +0000

Code Audit: DedeCMS V5.7 SP2 Vulnerability Collection

Thinking — Tue, 23 Jan 2018 00:00:00 +0000

Code Audit: Axublog Frontend SQL Injection to Backend GetShell

Thinking — Tue, 02 Jan 2018 00:00:00 +0000

PHPCMS 9.6.2 Audit: Arbitrary File Download Bypass and Front-End SQL Injection

Thinking — Tue, 19 Dec 2017 00:00:00 +0000

XXE Learning Path: Step by Step

Thinking — Thu, 07 Dec 2017 00:00:00 +0000

This post is a 2017 systematic write-up on XXE (XML External Entity Injection). The original motivation was OWASP TOP 10 2017 adding XXE as a dedicated entry (A4:2017-XML External Entities), so I consolidated scattered notes on DTD, entity declarations, in-band / out-of-band exploitation, and XML Schema extension attacks into a step-by-step reference. The original payloads and test conclusions are preserved verbatim; notes added at key points reflect version changes and modern hardening advice accumulated since 2017, so the two layers can be read side by side.

Code Audit: DuomiCms Global Filter Bypass

Thinking — Tue, 21 Nov 2017 00:00:00 +0000

APPCMS Code Audit: SQL Injection, XSS, CSRF and GetShell

Thinking — Fri, 17 Nov 2017 00:00:00 +0000

A First Look at PHP Deserialization and POP CHAIN

Thinking — Tue, 14 Nov 2017 00:00:00 +0000

I recently revisited a deserialization and POP CHAIN primer I wrote back in 2017 — at the time it was a beginner-friendly walkthrough. Re-reading it now, the core mechanics still hold up, but the attack surface around PHP deserialization has expanded substantially over the past few years. The phar stream wrapper has pushed deserialization triggers well beyond the unserialize() entry point, PHP 8 introduced __serialize/__unserialize to replace the Serializable interface, and tools like phpggc have turned mainstream framework gadget chains into an “plug-and-play” arsenal. Taking the chance of this revision, I’m keeping the original three examples as the introductory skeleton and supplementing the key turning points with side notes that fill in what has happened since — so this 2017 write-up does not stay frozen in 2017.

A Brief Summary of File Inclusion and PHP Pseudo Protocols

Thinking — Thu, 21 Sep 2017 00:00:00 +0000

This post is a 2017 write-up summarising PHP file inclusion vulnerabilities and the abuse of stream wrappers. It was first published under a “PHP Advanced Learning” section. The original test matrix and conclusions are preserved here, with annotations added at key points to reflect PHP version changes and modern hardening advice — those updates are marked as notes for easy comparison.

The protocols covered are file://, php://filter, php://input, zip://, compress.bzip2://, compress.zlib://, and data://. A follow-up post will dive into the individual inclusion functions.

Oracle SQL Injection Techniques: A Summary

Thinking — Thu, 31 Aug 2017 00:00:00 +0000

I’ve been running into Oracle injection tests more often lately, and solid writeups on the topic are surprisingly scarce online (MySQL material, by contrast, is everywhere). To speed up future testing and vulnerability hunting, I decided to revisit what I’d learned and put it all in one place. This post draws on Oracle’s official docs, fellow researchers’ blogs, and a few classic papers — feedback and discussion very welcome. Throughout, the user value is SQLINJECTION.

Note: This article was first written in August 2017. I’ve updated the version- and privilege-related details that have since gone stale and flagged the changes with side notes.

Thoughts from a CTF Challenge: A Few MySQL Quirks

Thinking — Fri, 19 May 2017 00:00:00 +0000

CVE-2017-9841 PHPUnit eval-stdin.php Remote Code Execution: When a PHP Testing Framework Becomes a Web Entry Point

Thinking — Mon, 15 May 2017 00:00:00 +0000

PHPUnit is one of the most popular unit testing frameworks in the PHP ecosystem, but its eval-stdin.php file is designed as a tool to “accept PHP code via the CLI” — if this file is accidentally deployed to the production environment’s web directory, an attacker can execute arbitrary PHP code through a simple POST request, CVSS 9.8, no authentication required.

CVE-2016-3053 IBM AIX Privilege Escalation: A Missing Trust Check in libc System Calls

Thinking — Tue, 15 Nov 2016 00:00:00 +0000

A missing identity check on a libc system call in IBM AIX gives any local unprivileged account a direct path to a root shell.