From a Schema Name to RCE in n8n
n8n uses a user-supplied schema name as a bare object key. Set it to __proto__, pollute the prototype, chain into RCE via the Git node. One request, full shell.
Simon Koeck
Security writeups, blog posts, and research by Simon Koeck.
Latest posts
How to Test Your PGP Email Setup End to End
Setting up PGP email is easy now. Confirming that the encryption, key discovery, and signing actually work end to end, less so. Here is how to test your PGP email setup, what can go wrong, and a free tool that does the round trip for you.
ELRS Security: What's Actually Possible Over the Air
I bought a Radiomaster running ExpressLRS and wanted to understand what an attacker could realistically do to a drone in flight. The answer is more interesting than the 2022 headlines suggested, and also more boring.
One Uppercase Letter Breaks Every Nuxt App
h3 powers every Nuxt app but only recognized 'chunked' in lowercase. Send 'ChunKed' instead and you get request smuggling.
Reading /etc/passwd via Translation Upload in Tolgee
Tolgee's XML translation importers ship with zero security config. Upload a crafted file, read anything from the server. Confirmed on their cloud platform.