JoeCyberTech

IPv6 SSRF Allow-List Bypass — Every IPv6 address category — loopback, ULA, link-local, IPv4-mapped and NAT64 — bypassed the dssrf library’s is_url_safe() check, enabling server-side request forgery. Fixed in dssrf 1.0.3.

SSRF Bypass in dssrf 1.0.3 (incomplete fix) — The latest version (1.0.3) can still be bypassed to reach all internal IPv4 ranges, IPv6 loopback/ULA/link-local, the AWS instance-metadata endpoint (169.254.169.254) and any internal host via a userinfo (user@host) prefix. This vector was not covered by the GHSA-8p33-q827-ghj5 fix, so 1.0.3 still needs updating.

Localhost SSRF via 1.1.1.1 DNS — When the DNS resolver is set to 1.1.1.1, dssrf treats localhost URLs as safe because the resolver returns NXDOMAIN for them, letting an attacker reach local resources. Affects ≤ 1.0.4; fixed in 1.0.5.

Network-Exposed ADB — The Allwinner H616 “TV98” TV box ships with Android Debug Bridge enabled and exposed on the network in production; an attacker who obtains ADB authorization can gain root-level access. Published by CISA.

HTTP/2 Session Crash (DoS) — axios’s Node.js HTTP/2 adapter opened ClientHttp2Session objects without an ‘error’ handler, so a malicious, unreachable or non-HTTP/2 endpoint could raise an uncaught exception and kill the entire Node.js process instead of rejecting the request. Affects axios ≥ 1.13.0 with httpVersion: 2. Fixed in 1.20.0.

XML Attribute Value Bypass — CRS did not inspect XML attribute values, so payloads placed inside attributes (e.g. a javascript: URI) evaded detection. Affected ~159 rules across 9 rule families at all paranoia levels; fixed by the CRS maintainers.

Charset Allow-List Bypass via Parameter Case — Rule 920480 matched only a lowercase charset parameter in the Content-Type header, so CHARSET=utf-7 or any mixed-case spelling skipped the charset allow-list entirely at PL1/PL2, reopening UTF-7/EBCDIC encoding evasion for other rules. Affects every CRS v4 release; fixed in 4.30.0 and 4.25.2 (LTS).

SSRF Bypass via .localhost TLD — A bypass of the earlier SSRF fix (GHSA-xw57-23p8-9wc5): hostnames under the reserved .localhost TLD (e.g. a.localhost) slipped past specifyjs’s outbound-request guard while still resolving to loopback, letting attacker-supplied URLs reach internal services. Affects @asymmetric-effort/specifyjs ≤ 1.0.x.

File-Extension Whitespace Bypass — Whitespace padding in a filename (e.g. “shell. php”) bypassed dangerous-extension upload rules that did not normalize whitespace before the extension check. Fixed in CRS 3.3.9 and 4.25.0.

Archive Path Traversal (Zip Slip) — IArchive.WriteToDirectory() in SharpCompress ≤ 0.47.4 let a malicious archive create directories outside the intended extraction root; combined with TAR symlink entries this escalates to arbitrary file writes with the process’s permissions. Fixed in 0.48.0.

Generate Lorem Ipsum Denial of Service — The Generate Lorem Ipsum operation had no bounds check on its Length parameter, so a crafted recipe exhausted resources — crashing the browser tab, or terminating the whole process when CyberChef runs as a Node backend. Affects CyberChef < 11.1.1 (npm and Docker image); fixed in 11.1.1.

install: Secret Exposure & Hard-Link Race — The fd-based copy path behind install -D created the destination with mode 0666 and without O_EXCL, so a file installed with -m 600 was readable by other local users during the copy, and a pre-planted hard link could redirect the privileged write. Affects coreutils ≤ 0.11.0. Fixed in 0.12.0.

Cookie Parser Confusion (WAF Bypass) — Coraza’s cookie parser trimmed only space and tab, so a control character next to “=” (e.g. a\v=\t') stayed in the cookie name or value while PHP and Python’s http.cookies strip it. The WAF and the backend saw different cookies, letting cookie-scoped SecRules miss the payload. Affects coraza/v3 < 3.8.1; fixed in 3.8.1.

kill: “-<PID>” Signals the Process — uutils kill treated an argument such as -62342 as a process to signal instead of rejecting it as an invalid signal the way GNU kill does, so a mistyped or crafted command line signals an unintended process. A variant of the earlier -1 issue. Affects coreutils < 0.10.0.