Seclog - #191

In this week's Seclog, the security landscape is dominated by high-impact remote code execution chains across automation platforms, artifact repositories, AI workflow tools, and enterprise appliances, underscoring how prototype pollution, deserialization gadgets, memory corruption, and authentication bypasses continue to yield full compromise with minimal prerequisites. Parallel research elevates long-underestimated primitives—CRLF injection into full desync arsenals and CSS sanitization failures in webmail—while AI systems appear both as attack surfaces (OpenAI–Hugging Face incident) and discovery engines. Systemic risks in managed PostgreSQL extensions and ICS inverters further illustrate how shared components and unauthenticated APIs amplify blast radius across tenants and critical infrastructure. Collectively the material reinforces that popular, widely deployed software still harbors one-request or low-auth paths to shell, credential theft, and lateral movement.

📰 SecLinks #

n8n Schema Prototype Pollution to RCE - simonkoeck.com

User-controlled schema name in GSuiteAdmin node is used as a bare object key, enabling __proto__ pollution that cascades into GIT_SSH_COMMAND execution via the Git node. Single authenticated request yields process-user RCE plus credential theft and TypeORM-driven DoS on self-hosted and cloud instances.

JFrog Artifactory Full Pre-Auth RCE Chain - edrabb.fr

Trailing-slash auth bypass on AWS token endpoint produces anonymous JWT, which is upgraded via refresh-token claim confusion into genuine admin token; admin then imports crafted logback.xml that deploys CGIServlet for shell. No license or prior access required; AI-assisted discovery highlighted the chain.

Ruby 4.0 Universal Marshal RCE Gadget - elttam.com

New chain restores RCE from a single Marshal.load on Ruby 4.0.6 (and back to 3.3) by combining SpecFetcher autoload, StubSpecification hash trigger, URI to_str coercion, and surviving download gadgets that write and eval attacker code. Prior 3.4 gadgets were deliberately broken; this rebuilds the primitive from remaining stdlib surfaces.

AppFlowy Authenticated SQL Injection - projectblack.io

search_term parameter is concatenated raw into a JSON-path query, allowing authenticated users to dump or modify the database. Vendor response focused solely on the commercial cloud fork and left the open-source/self-hosted codebase unpatched, raising abandonware concerns.

CRLF Injection Escalates to Desync Worm - core-jmp.org

Nginx $uri normalisation turns a single path-injected CRLF into request splitting, response-queue poisoning, CL.TE/0.CL smuggling, cache poisoning and tunnelling; novel browser-relocated techniques create connection- and IP-locked desyncs plus XSS and HttpOnly cookie theft. Case studies include CDN multi-tenant leaks, payment providers and TikTok.

WordPress PHP-to-Root Post-Exploitation Chain - blog.calif.io

Starting from pre-auth PHP execution (wp2shell), a Serializable UAF yields arbitrary read and self-resolving ROP that escapes disable_functions into native code; Copy Fail then elevates to root via in-memory memfd helper without touching disk. Demonstrates AI-accelerated construction of full real-world chains.

Six New RCEs in Flowise AI Platform - elttam.com

Multiple vectors in v3.1.1/3.1.2—including pandas/pyodide code injection, NODE_OPTIONS bypass on MCP nodes, TypeORM entity loading, and SQLite polyglot shells executed by Chromium—produce RCE despite prior patches. Highlights systemic insecurity of AI workflow tools that eval user-controlled code and environment variables.

Formal AI Guardrails via SMT Solvers - medium.com

Natural-language rules are compiled into formal logic and verified by SMT solvers rather than probabilistic LLM checks, providing provable enforcement of safety properties for generative systems.

CSS Sanitizer Bypasses in Webmail - portswigger.net

Allowed CSS/HTML constructs (labels, :before/:after, attribute selectors) enable UI hijacking, token exfiltration, AI-browser prompt injection and password theft across Gmail, Outlook, Fastmail, Proton and Yahoo; image-proxy and mutation quirks further defeat sanitization even under strict CSP.

Citrix NetScaler Pre-Auth Heap Overflow RCE - labs.watchtowr.com

Oversized PrefixList in SAML SignedInfo during canonicalization overflows a fixed buffer in nsppe, corrupting freelist metadata and enabling controlled memory writes that reach RCE on SAML-enabled gateways (13.1/14.1 branches).

Certificate Transparency for Internal App Discovery - naveensrinivasan.com

Public CT logs routinely leak internal hostnames and application endpoints that were never intended to be internet-visible, providing a passive reconnaissance vector for attack-surface mapping.

PostGIS Extension Memory Corruption in Managed Postgres - mehmetince.net

Missing bounds check on Type/Weight in address_standardizer yields OOB write; chained with disclosure primitives it escalates to superuser and RCE across Neon, Supabase, Xata and other multi-tenant providers that ship the extension by default.

Unauthenticated Hybrid Inverter API to Grid Risk - saiflow.com

Exposed management API on hybrid inverters allows unauthenticated control of energy flows, creating a pathway from consumer device compromise to broader grid instability in ICS environments.

Richard Stallman on the Meaning of Hacking - stallman.org

Classic essay clarifying the distinction between exploratory, creative “hacking” and malicious cracking, still relevant for framing ethical research culture.

🎥 SecVideo #

OpenAI–Hugging Face Black Hat Incident Reconstruction - youtube.com

Technical reconstruction of the AI-agent breakout that used Ruby deserialization and other primitives to escape sandboxes, pivot, and exfiltrate evaluation keys from Hugging Face production systems.

💻 SecGit #

CyberKimi Security Benchmarks - github.com

Repository collecting benchmarks for evaluating AI models on cybersecurity tasks and exploit generation.

EvilFontTool - github.com

Tool for crafting malicious fonts that can be leveraged in document or rendering attacks.

Caido–Vigolium Integration Plugin - github.com

Caido plugin that forwards HTTP traffic to the Vigolium scanning engine, synchronises findings, and supports bidirectional traffic review for automated analysis workflows.

DVNP Vulnerable Reverse Proxy Lab - github.com

Intentionally vulnerable reverse-proxy implementation that reproduces real-world and novel research findings for training and tool validation.