CVE-2023-45857-Demo

确认 axios 漏洞 CVE-2023-45857 行为的演示 1. 在 dev container 中启动 2. 在 app 容器中运行npm run dev 3. 访问 http://app.localhost 4. 在浏览器的开发者工具中确认 Cookie 中已设置XSRF-TOKEN 值为CREDENTIALTOKEN HttpOnly 为 false SameSite 为 Strict 5. 按下按钮 6. 在开发者工具中确认对whoami.localhost/api的请求的请求头中存在x-xsrf-token且值为CREDENTIALTOKEN 由于 whoami...

Lab-for-cve-2018-15133

摘要： 利用CVE-2018-15133反序列化漏洞 此利用针对Laravel框架5.5.40及5.6.x至5.6.29版本中的反序列化漏洞。 描述 远程代码执行可能源于对潜在不可信的X-XSRF-TOKEN值进行unserialize调用。这涉及Illuminate/Encryption/Encrypter.php中的decrypt方法以及phpggc中gadgetchains/Laravel/RCE/3/chain.php的PendingBroadcast。攻击者必须知道应用密钥，正常情况下这不会发生，但如果攻击者之前拥有特权访问权限或成功完成了之前的攻击，则可能发生。 前提条件...

CVE-2023-45857-Demo

验证 axios 漏洞 CVE-2023-45857 行为的演示 1. 在 dev container 中启动 2. 在 app 容器中执行 npm run dev 3. 访问 http://app.localhost 4. 使用浏览器开发者工具确认 Cookie 中已设置 XSRF-TOKEN 值为 CREDENTIALTOKEN HttpOnly 为 false SameSite 为 Strict 5. 点击按钮 6. 在开发者工具中，确认对 whoami.localhost/api 的请求中包含 x-xsrf-token 头部且值为 CREDENTIALTOKEN whoami...

exploit_laravel_cve-2018-15133

Laravel exploit for CVE-2018-15133 This code exploit CVE-2018-15133 and it is based on kosmiz's PoC and Metasploit's exploit for this vulnerability. I pretty much just did this for a box in Hack The Box, because I did not want to use Metasploit at the moment and as a excuse for practicing Python...

Larascript

| | | | | | / || '| / |/ | /|| ' || || ' \ | | | | | | || | | | | | | | | || | || | || , ||| ,|| / ||| ||| ./ | || 作者：@pwnedshell & @rsgbengi 📌 Larascript 是什么？ Larascript 是一个利用 CVE-2018-15133 漏洞的脚本，如果存在漏洞的 Laravel 应用暴露在外，它可以执行远程命令。你可以发送命令并获取响应，例如获取 cat /etc/passwd。但你也可以请求获取一个 shell，它会为你建立一个反向...

CVE-2026-40864

CVE-2026-40864 — 通过跨源表单 POST 绕过 JupyterHub XSRF（Sec-Fetch-Mode: no-cors） 严重级别 ：中等 CWE ：CWE-352 — 跨站请求伪造 XSRF 影响版本 ：jupyterhub 4.1.0 ≤ 版本 分配的模式——这恰恰是令牌本该阻止的经典 CSRF 向量。因此，任何接受简单表单体且仅依赖此 XSRF 检查的状态更改端点，都可被跨源伪造。 将其映射到实际端点：/hub/spawn（启动受害者的服务器）和 /hub/accept-share（让受害者接受攻击者服务器的共享）都是通过此检查的表单 POST。 影响...

vertx-web-xsrf

Panoramica Il CSRFHandlerImpl io.vertx.ext.web.handler.impl.CSRFHandlerImpl in Vert.x Web non crea token CSRF univoci per sessione utente. Un sito web malevolo può comunque effettuare un attacco CSRF ottenendo un token CSRF valido e aggiungendolo a un modulo HTML per poi inviarlo all'applicazione...

XSRFProbe

XSRFProbe Das führende Toolkit für Cross-Site-Request-Forgery-Audit und -Exploitation. -blue.svg...

axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name

A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service DoS, where the affected browser tab may...

CVE-2026-49854

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocketmask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided...

AZL-92382 CVE-2026-49854 affecting package python-tornado 6.3.3-11

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocketmask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided...

UBUNTU-CVE-2026-49854

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocketmask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided...

CVE-2026-49854

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocketmask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided...

PYSEC-2026-2534 JupyterLab vulnerable to potential authentication and CSRF tokens leak

Impact Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server version. Patches JupyterLab 4.1.0b2, 4.0.11, and 3.6.7 were patched. Workarounds No workaround has been identified, however users...

jupyterlab-git extension: Stored XSS leading to RCE

Overview Amazon Web Services AWS Security has identified a stored cross-site scripting XSS issue in the jupyterlab-git JupyterLab extension that can lead to remote code execution RCE. The issue exists in the PlainTextDiff.ts component, where the createHeader method passes Git filenames directly t...

Siemens RUGGEDCOM RST2428P Insertion of Sensitive Information Into Sent Data (CVE-2025-66035)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential...

Tornado has out-of-bounds memory access via C extension

Summary Tornado's optional native extension tornado.speedups implements websocketmask without validating that the mask argument is exactly four bytes long. The C function reads four bytes from mask unconditionally, even when Python passes a shorter byte string. This can read beyond the provided...

Buffer Over-read

Overview tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. Affected versions of this package are vulnerable to Buffer Over-read via the websocketmask function in the speedups component. An attacker can trigger a read past the end of the mas...

PT-2026-49059

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.5.6 Description The optional native extension tornado.speedups implements the websocket mask function without validating that the mask argument is exactly four bytes long. The C function reads four bytes from mask...

CVE-2026-44496

Axios is a promise based HTTP client for the browser and Node.js. Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who...