Cyber Attack on 思安录 | Thinking's Security Notes

CVE-2025-32433 Erlang/OTP SSH Pre-Auth RCE: Session Channel Eats Erlang Code

Thinking — Thu, 15 May 2025 00:00:00 +0000

Erlang/OTP’s SSH server hands client-sent “command strings” on session channels directly to the Erlang VM to parse and execute — after completing the SSH handshake, attackers send not a normal shell command but an Erlang expression (e.g. os:cmd("whoami")); OTP SSH executes it as code before authentication.

CVE-2025-52287 WSUS Deserialization to RCE: Four-Stage Exploitation via SimpleAuth Cookie Chain

Thinking — Tue, 15 Apr 2025 00:00:00 +0000

WSUS treats the SimpleAuth plugin’s authentication Cookie as “verified trust”, but the chain that generates the Cookie has no strict deserialization protection — attackers use a 4-stage attack (obtain session ID, get auth Cookie, use Cookie to trigger SimpleAuth, inject malicious .NET deserialization payload) to gain RCE on the patch distribution center.

CVE-2025-5777 Citrix NetScaler Memory Overread: From Reflection to Pre-Auth Memory Leak

Thinking — Sat, 15 Mar 2025 00:00:00 +0000

Citrix NetScaler reflects the user-supplied login field verbatim into the <InitialValue> tag of the login response XML — the attacker weaponizes this reflection point by sending an oversized login string, which triggers a memory overread in the NetScaler process and returns adjacent memory as part of the response, leaking session tokens, configuration, credentials, and other sensitive data.

CVE-2025-0133 GlobalProtect Gateway Reflected XSS: credential theft at the VPN portal

Thinking — Sat, 15 Feb 2025 00:00:00 +0000

The Palo Alto GlobalProtect VPN gateway login page does not filter user input. An attacker injects JavaScript via a malicious URL to steal user credentials.

CVE-2025-0108 PAN-OS Authentication Bypass: Palo Alto firewall compromised again

Thinking — Wed, 15 Jan 2025 00:00:00 +0000

Specific paths of the Palo Alto PAN-OS management interface do not enforce authentication. An attacker bypasses auth to access management functions directly, and combined with command injection, achieves unauthenticated RCE.

CVE-2025-0282 Ivanti Connect Secure Pre-Auth Stack Overflow RCE: Buffer Overflow on the VPN Gateway

Thinking — Wed, 15 Jan 2025 00:00:00 +0000

Ivanti Connect Secure exposes the pre-authentication welcome.cgi endpoint directly to the internet without any length check on request parameters — an attacker fills the stack buffer with 500 A’s, overwrites the return address with system(), and gets arbitrary command execution on the VPN gateway without any credentials.