Web Security on 思安录 | Thinking's Security Notes

0day Hunting the Day After xAI Open-Sourced grok-build (Part 4): ptyctl Test Server's Zero-Auth CORS and Cross-Origin RCE

Thinking — Mon, 20 Jul 2026 00:00:00 +0000

CVE-2025-53770 SharePoint WebPart Injection Deserialization RCE: Active Exploitation Before Patch Day

Thinking — Tue, 15 Jul 2025 00:00:00 +0000

SharePoint treats WebPart rendering as “trusted internal”, but the ToolPane.aspx endpoint accepts unauthenticated POST — attackers construct a malicious WebPart payload that triggers a .NET deserialization gadget chain, executing arbitrary commands on the SharePoint Server without authentication, and Microsoft has confirmed it is being exploited in the wild.

CVE-2025-44148 MailEnable Webmail Reflected XSS: Unsanitized state Parameter in failure.aspx

Thinking — Sun, 15 Jun 2025 00:00:00 +0000

MailEnable Webmail’s failure.aspx writes the state parameter verbatim into the HTML when displaying the error page — attackers craft a state=<script>...</script> URL, the victim clicks, MailEnable writes it without sanitization, triggering reflected XSS — stealing sessions, cookies, launching phishing.

CVE-2025-55184 React Server Components Infinite Loop DoS: A Single Payload Locks CPU

Thinking — Thu, 15 May 2025 00:00:00 +0000

React Server Components hand “client-sent request parameters” to the deserialization parser — attackers send a specially crafted payload, triggering the RSC parser to enter an infinite loop during deserialization, immediately consuming 100% CPU, and putting the entire service in an unavailable state.

Explore CMS v1.1 Reflected XSS: How a Community CMS's UserID Field Became the Attack Entry Point

Thinking — Thu, 15 May 2025 00:00:00 +0000

The user/login.php and admin/login.php endpoints in Explore CMS v1.1 perform zero sanitization or validation on the UserID field — an attacker can trigger reflected XSS with the simplest <script>alert(1)</script> payload, stealing sessions, cookies, and email content. This is especially dangerous for community CMS users.

CVE-2025-32395 Vite Dev Server Path Traversal: # Character Bypass of server.fs.deny

Thinking — Tue, 15 Apr 2025 00:00:00 +0000

Vite Dev Server’s server.fs.deny middleware uses regex matching on the URL to refuse access to files outside the project directory — but the # character per RFC 9112/9113 should only be used as a URL fragment, while Node.js by default allows # in the path. Attackers use this difference to craft /src/safe.txt#/../../../unsafe.txt, so fs.deny sees /src/safe.txt (in whitelist) but the filesystem actually accesses unsafe.txt (outside whitelist).

CVE-2025-4123 Grafana Full-Read SSRF + Account Takeover: Open Redirect + CSPT + Client-Side Traversal Chain

Thinking — Tue, 15 Apr 2025 00:00:00 +0000

Grafana’s staticHandler returns 302 when a directory is missing the trailing / — attackers use \attacker.com/? so FileSystem.Open parses it as a legitimate directory, but http.Redirect outputs it as an external URL; combined with render endpoint and plugin-app explore client-side path traversal, the three-stage chain delivers Account Takeover.

CVE-2025-30406 CentreStack Deserialization to RCE: Hard-coded Machine Key + ASP.NET ViewState Exploitation

Thinking — Tue, 01 Apr 2025 00:00:00 +0000

CentreStack hard-codes ASP.NET’s MachineKey (the validation key for ViewState signing) into the product configuration — attackers only need to extract this key from the product source or binary, use ysoserial to craft a malicious ViewState, and trigger ASP.NET-side deserialization to execute arbitrary commands; the entire attack chain requires no authentication.

CVE-2025-29927 Next.js Authentication Bypass: x-middleware-subrequest Recursion Depth Evasion

Thinking — Sat, 22 Mar 2025 00:00:00 +0000

Next.js uses the x-middleware-subrequest header with recursion depth (MAX_RECURSION_DEPTH=5) to decide “is the current request a legitimate subrequest?” — attackers only need to put 5 repeated middleware paths in the header to trigger the “internal subrequest” judgment and completely skip middleware’s authentication, authorization and CSP checks.

CVE-2025-24813 Apache Tomcat Path Equivalence + Persistent Session RCE: Partial PUT and Default Servlet Converging

Thinking — Sat, 15 Mar 2025 00:00:00 +0000

Tomcat’s default servlet serves as a “static file server” with both read and write capability exposed — the attacker uses a Content-Range partial PUT to write a JSP payload into Tomcat’s work directory, then a GET request makes default servlet compile and execute it as JSP. The whole RCE chain completes on the public internet.

CVE-2025-27415 Nuxt.js Cache Poisoning DoS: Newline Bypass on Route Regex

Thinking — Sat, 15 Mar 2025 00:00:00 +0000

Nuxt.js’s Nitro route regex treats newline (\n) as a legal character — the attacker stuffs newlines and spaces into the URL, bypasses the route regex’s key extraction, and makes Nitro write an empty key into the cache. Repeated requests grow the cache without bound and exhaust server memory for DoS.

CVE-2024-12877 GiveWP PHP Object Injection: When unserialize Meets Magic Methods

Thinking — Sat, 15 Feb 2025 00:00:00 +0000

GiveWP calls unserialize() on user-controlled fields, and PHP automatically fires magic methods when deserializing. An attacker only needs to ship an object with the right magic method — PHP itself will run the attacker’s code, bypassing the early is_serialized regex that only recognized array and object types.

CVE-2024-12877 GiveWP PHP Object Injection: unserialize vs. Regex, a Futile Fight

Thinking — Wed, 15 Jan 2025 00:00:00 +0000

GiveWP calls unserialize() on user input and tries to gate it with a regex “is this serialized?” check. But as long as the underlying call is unserialize, regex is decoration. Once the attacker slips past the regex, magic methods like __wakeup() take over execution flow — and the chain rolls from injection to RCE.

CVE-2024-10793 WP Activity Log: Stored XSS to RCE in the Audit Page

Thinking — Wed, 25 Dec 2024 00:00:00 +0000

WP Activity Log writes user behavior into the log page with zero sanitization. Once the stored XSS fires, the attacker grabs the admin nonce and uploads a PHP webshell — the entire chain goes from a single log entry all the way to RCE.

CVE-2024-10793 WP Activity Log Stored XSS to RCE: Unsanitized Writes to the Admin Render Plane

Thinking — Thu, 19 Dec 2024 00:00:00 +0000

WP Activity Log treats the admin’s “activity log” panel as a trusted render plane, but leaves the write path unsanitized — an attacker injects HTML through admin-ajax, and any admin who opens the panel is compromised. With stolen nonce credentials plus a plugin upload, the chain from anonymous POST to RCE is complete.

Three npm Vulnerabilities in lunary-ai: SAML XSS, IDOR, and Privilege Escalation on the Same Trust Chain

Thinking — Thu, 19 Dec 2024 00:00:00 +0000

The same npm package lunary-ai/lunary (before 1.6.7) exposed three CVEs at once — Stored XSS in SAML metadata, IDOR in the PATCH score endpoint, and Privilege Escalation in the PATCH model endpoint. All three trace to the same root: the boundary between authentication and authorization, the one that’s so easy to overlook.

CVE-2024-52875 Kerio Control CRLF Injection to 1-click RCE: silent firewall takeover

Thinking — Mon, 16 Dec 2024 00:00:00 +0000

The Kerio Control firewall’s web admin interface does not filter CRLF characters. An attacker crafts a malicious link, lures the admin to click, and gets a shell on the firewall with 1-click.

CVE-2024-46982 Next.js Cache Poisoning: silent hijacking of non-dynamic SSR pages

Thinking — Fri, 15 Nov 2024 00:00:00 +0000

Next.js non-dynamic SSR pages do not isolate user-specific data at the cache layer. An attacker poisons the cache with a malicious Host header, and all subsequent users receive the poisoned response.

CVE-2024-9264 Grafana DuckDB SQLi to RCE: authenticated database piercing

Thinking — Tue, 15 Oct 2024 00:00:00 +0000

Grafana 11.0.0-11.2.1’s SQL query interface allows authenticated users to inject DuckDB commands, read arbitrary files, and under specific configurations, achieve RCE directly.

CVE-2024-5420 SEH UTN Server XSS: cross-site scripting in USB device management interface

Thinking — Thu, 15 Aug 2024 00:00:00 +0000

The SEH UTN Server’s USB device management web interface does not filter user input. An attacker crafts a malicious URL to inject JavaScript and steal the admin session.

CVE-2024-27956 WP Automatic SQL Injection: from 9.9 plugin bug to admin account takeover

Thinking — Mon, 15 Jul 2024 00:00:00 +0000

The WordPress valvePress/Automatic plugin does not filter %0a or null bytes in the auth parameter. An attacker bypasses auth, runs SQL injection through the q parameter, and eventually creates an eviladmin account to take over the site.

CVE-2024-38475 Apache HTTPD mod_rewrite path traversal: from BlackHat 2024 to RCE

Thinking — Mon, 15 Jul 2024 00:00:00 +0000

A path-matching logic flaw in Apache HTTPD mod_rewrite, CVSS 9.1, disclosed at BlackHat 2024. An attacker crafts a special URL to bypass rewrite rules and access restricted files.

CVE-2024-40725 Apache HTTPD HTTP request smuggling: Content-Length parsing inconsistency

Thinking — Mon, 15 Jul 2024 00:00:00 +0000

Apache HTTPD processes Content-Length headers with special characters differently from the proxy/backend, letting an attacker craft a special request to perform HTTP request smuggling.

CVE-2024-4956 Sonatype Nexus OSS Path Traversal: from artifact repository to arbitrary file read

Thinking — Mon, 15 Jul 2024 00:00:00 +0000

Sonatype Nexus Repository OSS does not sufficiently filter paths, letting an attacker craft a special URL to read arbitrary files on the server without authentication.

CVE-2024-38094 Microsoft SharePoint RCE: unauthenticated remote code execution

Thinking — Tue, 09 Jul 2024 00:00:00 +0000

A remote code execution vulnerability in Microsoft SharePoint Server, CVSS 6.3, lets an attacker bypass authentication via a crafted request and execute arbitrary code, affecting a large number of enterprise SharePoint deployments.

CVE-2023-7137 Client Details System 1.0 SQL Injection: classic boolean-based bug in uemail

Thinking — Thu, 04 Jul 2024 00:00:00 +0000

Client Details System 1.0 concatenates the uemail parameter directly into a SQL query. An attacker uses the classic OR 1=1 to bypass login, then hands the request to SQLmap to dump the entire database.

CVE-2024-7954 Prote_plume Plugin RCE: from open-source security tool to unauthenticated RCE

Thinking — Mon, 20 May 2024 00:00:00 +0000

The Prote_plume security scanning plugin itself contains an unauthenticated RCE, CVSS 9.8. An attacker can execute arbitrary commands on the server with a simple request.

CVE-2023-50164 Apache Struts File Upload Path RCE: A Classic Bug in a Classic Framework

Thinking — Wed, 15 May 2024 00:00:00 +0000

Apache Struts’ file upload parameter handling allows path manipulation — an attacker uploads a file to an arbitrary location and triggers RCE via OGNL injection.

CVE-2023-46943 JWT Token Verification Bypass: from missing signature checks to identity spoofing

Thinking — Wed, 01 May 2024 00:00:00 +0000

JWT libraries do not enforce signature checks by default — developers have to opt in. An attacker changes alg to none or swaps the key to bypass authentication directly.

CVE-2024-4439 WordPress Core Unauthenticated Stored XSS: Block Editor rendering chain

Thinking — Tue, 09 Apr 2024 00:00:00 +0000

WordPress Core versions prior to 6.5 do not sufficiently filter content when rendering in the Block Editor. An attacker-crafted post can trigger an unauthenticated stored XSS.

CVE-2024-23724 Ghost CMS SVG Stored XSS: from avatar upload to Owner takeover

Thinking — Fri, 22 Mar 2024 00:00:00 +0000

Ghost CMS lets users upload SVG files as avatars without sanitization. An attacker uses a JavaScript-bearing SVG to hijack the Owner’s session and escalate from Contributor to Admin to Owner.

CVE-2024-29291 Laravel database credential leakage: the PDOException logging mistake

Thinking — Fri, 22 Mar 2024 00:00:00 +0000

When a PDO exception is thrown, Laravel writes the full database connection information, including the password, to the log. Anyone who gets the log can connect to the database with the leaked DSN, user, and password.

CVE-2023-7028 GitLab Account Takeover: dual-recipient password reset

Thinking — Thu, 14 Mar 2024 00:00:00 +0000

GitLab’s password reset flow lets a single request deliver mail to multiple addresses. The attacker appends their own inbox to the victim’s reset request and takes over the account.

CVE-2023-6553 WordPress Backup Migration Unauthenticated RCE: PHP filter chain weaponized

Thinking — Thu, 29 Feb 2024 00:00:00 +0000

The WordPress Backup Migration plugin’s includes/backup-heart.php endpoint mishandles user input. An attacker uses a PHP filter chain to write a shell to disk and take over the server without authentication.

CVE-2023-4357 Chrome XEE on WebBrowsers: from XML external entity to arbitrary file read

Thinking — Mon, 15 Jan 2024 00:00:00 +0000

The Chrome browser’s XML parser does not disable external entity loading when processing user-controlled XML. An attacker crafts malicious XML to read local files.

CVE-2024-22144 WordPress GOTMLS Plugin Code Injection: a 200k-install string concatenation bug

Thinking — Mon, 15 Jan 2024 00:00:00 +0000

The WordPress GOTMLS plugin (200k+ active installs) does not parameterize user input. An attacker can run arbitrary PHP on the server through simple string concatenation.

CVE-2024-34351 Next.js SSRF: Server Actions and the Host Header's Quiet Collusion

Thinking — Mon, 15 Jan 2024 00:00:00 +0000

Next.js’ Server Actions trust the user-controlled Host header during a redirect flow. An apparently innocent internal fetch exposes internal HTTP services to any external attacker — and a Flask pivot upgrades the SSRF from a ping to a full read.

CVE-2023-50164 Apache Struts: Path Traversal in File Upload to RCE

Thinking — Fri, 15 Dec 2023 00:00:00 +0000

Apache Struts’ ActionSupport does not strictly validate upload paths, so changing a single multipart field name lets attackers drop a webshell straight into Tomcat webapps — yet another round of the old path-traversal-to-RCE story hitting Struts in 2023.

CVE-2023-49103 + CVE-2023-49105 ownCloud Info Leak + Privilege Escalation to RCE Chain: How PHPinfo Exposure Became the Attacker's Key

Thinking — Wed, 15 Nov 2023 00:00:00 +0000

ownCloud exposes the full PHPinfo page on a few endpoints such as /settings/phpinfo (CVSS 10), and at the same time the WebDAV URL signature defaults to an empty string when the user has not configured a signing key, allowing the attacker to forge a request for any username (CVSS 9.8) — the two CVEs combine into a complete attack chain: PHPinfo exposure gives away ImageMagick / GraphQL information → WebDAV signature forgery lets the attacker impersonate any user → old ImageMagick vulnerability triggers RCE.

CVE-2023-43341 Evolution CMS Reflected XSS: Reflected Attack Surface in the Admin Panel

Thinking — Fri, 15 Sep 2023 00:00:00 +0000

Evolution CMS lacks escape on multiple parameters in the admin panel — URLs crafted by attackers directly trigger XSS when an admin clicks them, giving full backend control.

CVE-2023-38286 Spring Boot Admin SSTI: Thymeleaf Expression Injection to RCE

Thinking — Tue, 22 Aug 2023 00:00:00 +0000

Spring Boot Admin’s UI view layer uses Thymeleaf — but Thymeleaf prior to 3.1.0’s view name resolution allows attackers to inject SpEL expressions via request headers, and the template engine executes arbitrary Java code when parsing the view path.

CVE-2023-4357 Chrome LibXSLT XEE: The XML External Entity Surface Browsers Forgot

Thinking — Tue, 22 Aug 2023 00:00:00 +0000

WebKit-based browsers like Chrome ship LibXSLT as their default XSL engine, but its document() function still allows loading external entities — so file:// resources outside the sandbox quietly get read. This is a browser-side XEE writeup built around a consistency gap.

CVE-2023-25157 GeoServer SQLi: Property Injection in OGC API Filters

Thinking — Sat, 22 Apr 2023 00:00:00 +0000

GeoServer’s WFS/WMS GetFeature requests accept OGC Filter parameters — but the property name field has zero SQL escape, and attackers can splice arbitrary SQL subqueries straight into it to harvest the entire database.

CVE-2023-24488 QR Code Generator XSS: A Stored XSS on code-projects.org

Thinking — Tue, 21 Feb 2023 00:00:00 +0000

The open-source QR Code Generator on code-projects.org concatenates user input directly into an href link when generating the QR Code preview — write a javascript:alert(1) in, and the moment the QR Code is scanned, XSS fires.

CVE-2022-48110 CKEditor 5 XSS: Sanitizer Gaps in data: URL Schemes

Thinking — Sat, 10 Dec 2022 00:00:00 +0000

After CKEditor 5 switched to the model + view two-layer architecture, the XSS risk should have been eliminated — but the sanitizer still missed URL forms like the data: protocol header during model→view deserialization.

CVE-2021-39316 DZS Zoomsounds: Unauthenticated Arbitrary File Read

Thinking — Sun, 15 Aug 2021 00:00:00 +0000

The DZS Zoomsounds plugin has a download endpoint that reads whatever path the client passes, with no permission check — crafting ../../../wp-config.php is enough to read the database password.

CVE-2021-3129 Laravel Ignition RCE: Phar Deserialization Path in Debug Mode

Thinking — Tue, 02 Feb 2021 00:00:00 +0000

Laravel’s Ignition error page gives developers a “click to fix” button — but the underlying logic is phar deserialization. If an attacker can write a PHP-serialized payload into a file Laravel treats as a log, they get control of the entire process.

CVE-2020-981 CKEditor 4 XSS: Sanitizer Boundaries in Rich Text Editors

Thinking — Tue, 12 May 2020 00:00:00 +0000

CKEditor 4’s sanitizer has a gap in handling certain HTML tag-attribute combinations prior to v4.13 — a single crafted HTML snippet is enough to inject Stored XSS into every application that uses CKEditor 4.

CVE-2019-15107 Webmin Unauthenticated RCE: command injection in password_change.cgi

Thinking — Wed, 28 Aug 2019 00:00:00 +0000

Webmin’s password_change.cgi does not filter the old parameter when passwd_mode=2 is set, letting unauthenticated attackers inject a pipe into the unix_crypt shell path and execute arbitrary commands.

Code Audit: Z-BlogPHP 1.5.1 Zero GetShell Vulnerability Analysis

Thinking — Thu, 19 Apr 2018 00:00:00 +0000

Code Audit: YXCMS 1.4.6 Vulnerability Collection

Thinking — Thu, 08 Feb 2018 00:00:00 +0000

Code Audit: DedeCMS V5.7 SP2 Vulnerability Collection

Thinking — Tue, 23 Jan 2018 00:00:00 +0000

XXE Learning Path: Step by Step

Thinking — Thu, 07 Dec 2017 00:00:00 +0000

This post is a 2017 systematic write-up on XXE (XML External Entity Injection). The original motivation was OWASP TOP 10 2017 adding XXE as a dedicated entry (A4:2017-XML External Entities), so I consolidated scattered notes on DTD, entity declarations, in-band / out-of-band exploitation, and XML Schema extension attacks into a step-by-step reference. The original payloads and test conclusions are preserved verbatim; notes added at key points reflect version changes and modern hardening advice accumulated since 2017, so the two layers can be read side by side.

A First Look at PHP Deserialization and POP CHAIN

Thinking — Tue, 14 Nov 2017 00:00:00 +0000

I recently revisited a deserialization and POP CHAIN primer I wrote back in 2017 — at the time it was a beginner-friendly walkthrough. Re-reading it now, the core mechanics still hold up, but the attack surface around PHP deserialization has expanded substantially over the past few years. The phar stream wrapper has pushed deserialization triggers well beyond the unserialize() entry point, PHP 8 introduced __serialize/__unserialize to replace the Serializable interface, and tools like phpggc have turned mainstream framework gadget chains into an “plug-and-play” arsenal. Taking the chance of this revision, I’m keeping the original three examples as the introductory skeleton and supplementing the key turning points with side notes that fill in what has happened since — so this 2017 write-up does not stay frozen in 2017.

A Brief Summary of File Inclusion and PHP Pseudo Protocols

Thinking — Thu, 21 Sep 2017 00:00:00 +0000

This post is a 2017 write-up summarising PHP file inclusion vulnerabilities and the abuse of stream wrappers. It was first published under a “PHP Advanced Learning” section. The original test matrix and conclusions are preserved here, with annotations added at key points to reflect PHP version changes and modern hardening advice — those updates are marked as notes for easy comparison.

The protocols covered are file://, php://filter, php://input, zip://, compress.bzip2://, compress.zlib://, and data://. A follow-up post will dive into the individual inclusion functions.

Thoughts from a CTF Challenge: A Few MySQL Quirks

Thinking — Fri, 19 May 2017 00:00:00 +0000

CVE-2017-9841 PHPUnit eval-stdin.php Remote Code Execution: When a PHP Testing Framework Becomes a Web Entry Point

Thinking — Mon, 15 May 2017 00:00:00 +0000

PHPUnit is one of the most popular unit testing frameworks in the PHP ecosystem, but its eval-stdin.php file is designed as a tool to “accept PHP code via the CLI” — if this file is accidentally deployed to the production environment’s web directory, an attacker can execute arbitrary PHP code through a simple POST request, CVSS 9.8, no authentication required.