christbowel
IT Sicherheit, meine Leidenschaft :)
Offensive Security
Researcher &
Software Security.
Turning attack surfaces into CVEs.
×13// intelligence_feed
Latest Writeups.
TorchServe LPE: a fixed temp path, and a model server that trusts it
A predictable extraction directory in /tmp lets a local user swap the model handler and run code as the TorchServe service account. No race, no root, just a parent directory and rename(2).
XSS2Shell: Technical Analysis
A pre-auth reflected XSS in WordPress Core, patched in 7.0.3. Two sanitizers disagree about what a tag is, and a username walks through the gap. This is the breakdown: gdb on the PHP tokenizer, the real affected range (which every public writeup got wrong), the JS gadget the patch did not touch, and a detector.
From One Row of Data to a Root Shell: Five CVEs in Perspective 5.0.0
Five vulnerabilities in the Perspective analytics engine, including an unsandboxed eval() in the query path and a stored XSS in the plugin that loads by default. Chained, they take an attacker from writing one row of data to command execution on the server host.