Research Archive
Browse entries by research type, time, topic, and threat domain. This page behaves more like an archive than a feed.
CVE-2025-52287 is a Windows Server Update Services deserialization RCE, CVSS 9.8. Attackers use a 4-stage chain (obtain ID → grab cookie → use cookie to trigger SimpleAuth → inject deserialization payload) to gain RCE on the WSUS server, controlling the enterprise patch distribution center.
After nearly a month of forensic investigation into multiple cryptocurrency exchange breaches, I and 23pds confirmed the attacker as Lazarus Group. This article discloses the complete set of IOCs and TTPs, including social engineering entry, PyYAML RCE backdoor deployment, and lateral movement to wallet servers.
CVE-2022-41082 is a Server-Side Request Forgery in Microsoft Exchange Server prior to 15.2 (Build 986.5), CVSS 8.0, sitting at the front of the ProxyNotShell attack chain. The vulnerability lives in the Outlook Web Access `autodiscover.json` endpoint, where the `Email` field of an AutodiscoverV1 request is parsed as a URL and used by the Exchange back-end to make an outbound HTTP call. An attacker can steer that back-end call at Exchange's own internal PowerShell Remoting service (reachable on localhost by default), turning what looks like a low-severity SSRF into the prerequisite for the chained CVE-2022-41040 RCE. The full chain — SSRF reaching the internal PowerShell endpoint, then arbitrary PowerShell command execution under the Exchange SYSTEM identity — was mass-exploited by APT-class actors between September and December 2022, with thousands of Exchange servers compromised worldwide, and a non-trivial number of incidents ending in ransomware deployment. The lesson is that on a system like Exchange, which is both internet-facing and embeds an internal PowerShell service, any SSRF that bypasses URL validation is effectively a free RCE pre-stage.
CVE-2020-10770 is a Server-Side Request Forgery in Keycloak versions prior to 13.0.0, caused by improper validation of the `request_uri` parameter in the OIDC authentication flow, scored CVSS 6.1. The Keycloak server blindly follows any URL the attacker puts in `request_uri`, turning the identity provider itself into a proxy for arbitrary outbound requests. In practice this lets attackers reach internal services that are normally firewalled off, scan ports from the Keycloak server's network position, and — most damagingly — pull cloud-credential material from the IMDS endpoint at 169.254.169.254 on EC2/Azure/GCP, which often leads directly to cloud account takeover. The root cause is a missing URL egress control on a feature designed to fetch a signed `request_uri` JWT from a known client: Keycloak 12.x and earlier forwarded the parameter as-is to its HTTP client, so any URL the attacker placed there was fetched on the server's own network. Patching to 13.0.0+ closes the hole, but until then operators need an explicit network egress policy blocking private IP ranges and IMDS, plus a forced move to IMDSv2 on EC2.
CVE-2016-3053 is a missing EUID check in the AIX 6.1 / 7.1 / 7.2.0.2 libc implementations of `setauthdb` and `ruserok`, scored CVSS 9.8. A local unprivileged account can flip the authentication database and write passwordless trust for any host+root pair, then `rlogin` straight into a root shell without ever owning a root credential. The flaw is most often weaponized after a lower-privilege foothold — a compromised web user, a misconfigured daemon, a shared virtualization host — and is exactly the kind of bug that turns a single low-priv shell into full system compromise. The fix ships in IBM APARs IV88616 / IV88617 / IV88618 and depends on the AIX release.