will frame / bugs

bugs

home | talks | bugs | projects | contact

MediaWiki CVE-2026-102966 Not yet published

Portainer low-priv user to RCE 8th October 2026

Found that it was possible to achieved RCE as a low-privileged user in a Portainer instance with a malicious volume creation. The bind-mount guard only rejected DriverOpts["type"] == "bind", so passing type=none, o=bind, device=/ created a volume mapping the host root straight into a container. Ended up marked as a duplicate but credited as part of a huge advisory (GHSA-jmr9-98g4-2phv)

Bruno arbitrary host file read 1st October 2026

Discovered that in the API client Bruno, symlinks could be placed within a collection, and with a maliciously crafted pre-request script on an otherwise normal request, arbitrary files could be posted to an attacker-controlled server. Patch included the removal of __brunoLoadLocalModule from user scripts, and the bug got its own version number v4.2.1.

Tailcat file enum/overwrite 3rd September 2026

Found methods to overwrite or enumerate existing files in an exposed drop-box in Tailcat, a tool from Tailscale. This was performed by passing specific SFTP flags which would allow a request to only succeed if the file existed on the server.

Last.fm open redirect leading to account API token leak 2nd June 2026

Some open redirect issues found in Last.fm, one of which would leak the user's API token, which could allow for an attacker to add listens to tracks, favourite/unafavourite tracks, and manage tags for tracks, albums, and artists. Was never patched.

Silverstripe - Zero-click to account takeover 21st January 2025

Working off the back of a finding from Jason Xie which had remained unpatched, in which sending a password reset HTTP request with a custom Host header would use the user-supplied Host header in constructing the password reset URL. This would leak the password reset token of a victim if an attacker supplied a controlled server as a Host header, and if the victim clicked on the URL. I discovered that when targeting administrators which used Microsoft Outlook for email, SafeLinks would click the poisoned/suspicious URL as it landed in the victim's inbox, and the password reset token would immediately be sent to the attacker's controlled server. Ran a (harmless) scan against 2,511 sites, 1,305 appeared to be applicable to the original vulnerability, with 207 of the sites appearing to use Microsoft Outlook as a mailserver. Resulted in a new more clear warning being created when the SS_ALLOWED_HOSTS variable wasn't set, which is an allowlist of Host header values.

Player IP address disclosure in Valve's "Deadlock" 16th December 2024

Found that <img> tags in Deadlock's in-game chat would trigger an HTTP request to be sent to it even though the tags did not render in-game. This HTTP request would disclose IP addresses of all players in the lobby.