Security Research
Vulnerabilities I've reported and helped fix, along with the CVEs and security advisories.
- Maintenance record disclosure via missing authorization
Snipe-IT is an open-source IT asset management system. Its maintenance record view rendered a record without the authorization check that every other action in the controller applied, so any activated user in the asset's company could open one by walking the sequential /maintenances/{id} URLs. A permissionless account could therefore read the maintenance details of every record in its company, including the linked asset, supplier, purchase cost, and free-text notes.
- Stored XSS via home link setting
Shaarli is an open-source, self-hosted bookmarking application. Its 'Home link' setting was HTML-escaped but not protocol-filtered before being rendered into the href of the site title link shown on every page, so an administrator could store a javascript: URI. Any visitor who then clicked the title link would run attacker-controlled JavaScript in the site's origin.
- Moderator note disclosure via user note endpoint
Lichess is a free, open-source online chess platform. Its user note endpoint enforced authentication but no permission check, so passing inquiry=1 returned every non-dox moderator note about the named account. Any logged-in user could read the moderation team's private notes on any account, including banned and closed ones, and each request also planted a note on the target.
- Unauthenticated RCE via email-attachment path traversal
Receipt Wrangler is an open-source, self-hosted receipt-management app. Its IMAP poller wrote each email attachment to disk using the raw MIME filename with no path checks, so a traversal filename escaped the temp directory and wrote attacker-controlled bytes anywhere the process could reach. With the shipped images running as root, an unauthenticated attacker could email a monitored inbox, overwrite the app's own Python, and gain remote code execution on the next poll.
- Arbitrary directory creation and recursive deletion via group name
Receipt Wrangler is an open-source, self-hosted receipt-management app. Group storage paths were built from the group name without sanitization, so a name containing traversal sequences resolved outside the data directory for both directory creation and the recursive-delete hook that ran when a group was removed. Any authenticated user could create directories and write receipt files anywhere the process could reach, and recursively delete arbitrary directories, wiping every group's stored receipts or the app's own files.
- Group member self-escalation via unchecked role id
Receipt Wrangler is an open-source, self-hosted receipt-management app. Its group-update endpoint was gated only on the generic group.update permission, then replaced the entire member list, including each member's role id, with whatever the caller submitted. Any member able to edit a group could set their own role to Owner and seize full control, or drop the legitimate owner by leaving them out of the request.
- SQL injection via category and tag name lookup
Receipt Wrangler is an open-source, self-hosted receipt-management app. Its category and tag name-count lookups built the SQL WHERE clause with string formatting and passed it to the ORM unparameterized, so the name path parameter reached the database unescaped. An account with category or tag read access could inject a boolean-blind query and read arbitrary rows from any table, including other users' password hashes, email credentials, and API keys.
- Private broadcast exfiltration via relay round sync
Lichess is a free, open-source online chess platform. Its broadcast relay could sync a round's games from another Lichess broadcast, an action meant to require the Relay permission. The permission check read the source URL's host, while the code that resolved the round read its path. A URL on any unrelated host that carried a valid round id therefore slipped past it and still loaded the round, with no visibility check applied. Any account that knew a private broadcast's eight-character round id could read all of its games, moves, and annotations, and republish them through a public broadcast.
- Account takeover of invited students via password reset
Lichess is a free, open-source online chess platform. Its class password-reset action omitted the ownership check that its other class actions enforced. Any self-appointed teacher could reset and read the password of any user who accepted a class invite, taking over their account.
- Remote code execution via CivetWeb config injection
Pi-hole is a network-wide DNS ad blocker, and FTL is its embedded DNS and API engine. An admin-controlled setting accepted arbitrary web-server options with no allowlist, while a separate import wrote an attacker-supplied file to disk unchecked. Chained together, an authenticated admin could run arbitrary code on the host.
- Path traversal / arbitrary file read via investigation downloads
AIL Framework is an open-source platform for analyzing and detecting information leaks in unstructured data. Its investigation download feature joined user-controlled identifiers to storage paths without keeping the result inside the intended directories. An authenticated user could traverse the filesystem and pull arbitrary readable files into a generated archive.
- 2FA TOTP brute-force via missing rate limit
AIL Framework is an open-source platform for analyzing and detecting information leaks in unstructured data. Its two-factor verification step placed no limit on failed one-time-code attempts. An attacker who had passed the password stage could brute-force the second factor and bypass 2FA to reach the account.
- Complete 2FA bypass via /api/auth/token
Sync-in is a self-hosted file sync and sharing server. Its token endpoint authenticated on username and password alone and issued full session tokens without checking whether the account had 2FA enabled. Anyone holding valid credentials for a 2FA-protected account could bypass the second factor in a single request.
- ReDoS via unsanitized regex in sync diff pathFilters
Sync-in is a self-hosted file sync and sharing server. Its sync-diff endpoint compiled a user-supplied value into a regular expression and ran it synchronously with no complexity checks. A catastrophic-backtracking pattern could stall the server's event loop and deny service to other users.
- TOTP brute-force via /api/app/sync/register
Sync-in is a self-hosted file sync and sharing server. Its sync-client registration endpoint failed to advance the account lockout counter on failed TOTP attempts. An attacker could brute-force the second factor and, on a successful guess, register a client or disable MFA outright.
- Authenticated path traversal via /objects/item/diff
AIL Framework is an open-source platform for analyzing and detecting information leaks in unstructured data. Its item-diff endpoint compared item contents before confirming both items existed, so crafted identifiers could escape the intended storage directory. An authenticated user could read arbitrary gzip-compressed files from the server's filesystem.
- Log flooding via crafted search queries
BookStack is an open-source wiki and documentation platform. Its search system mishandled certain crafted queries, raising errors instead of rejecting them cleanly. An attacker could abuse this to generate repeated errors and flood the application's logs.
- Account escalation via CSV import
Snipe-IT is an open-source IT asset management system. Its CSV user importer rebuilt the update payload from the raw CSV row rather than the authorization-checked model, so a user holding only the import permission could set fields they were not allowed to change. This let an attacker overwrite another user's email and take over the account through a password reset.
- TOTP brute-force via missing rate limit
Snipe-IT is an open-source IT asset management system. Its two-factor verification endpoint enforced no rate limiting or attempt counter, leaving TOTP codes open to unlimited guessing. An attacker with valid credentials could brute-force the second factor to finish logging in and, where 2FA was optional, disable it entirely.
- MFA brute-force via missing rate limit
BookStack is an open-source wiki and documentation platform. Its multi-factor verification routes enforced no rate limiting. An attacker could brute-force a user's second factor to get past MFA.