CVE-2023-45857-Demo

确认 axios 漏洞 CVE-2023-45857 行为的演示 1. 在 dev container 中启动 2. 在 app 容器中运行npm run dev 3. 访问 http://app.localhost 4. 在浏览器的开发者工具中确认 Cookie 中已设置XSRF-TOKEN 值为CREDENTIALTOKEN HttpOnly 为 false SameSite 为 Strict 5. 按下按钮 6. 在开发者工具中确认对whoami.localhost/api的请求的请求头中存在x-xsrf-token且值为CREDENTIALTOKEN 由于 whoami...

exploit_laravel_cve-2018-15133

针对 CVE-2018-15133 的 Laravel 漏洞利用 该代码利用了 CVE-2018-15133，其基于 kosmiz 的 PoC 和针对此漏洞的 Metasploit 漏洞利用模块。我做这个主要是为了 Hack The Box 上的一台机器，因为当时不想用 Metasploit，同时也当作练习 Python 的一个借口。 以下摘自 CVE 的描述： 在 Laravel Framework 5.5.40 及更早版本、5.6.x 至 5.6.29 版本中，对可能不可信的 X-XSRF-TOKEN 值执行 unserialize 调用时，可能会导致远程代码执行。这涉及...

CVE-2023-45857-Demo

Demo para verificar el comportamiento de la vulnerabilidad CVE-2023-45857 de axios 1. Iniciar en el dev container 2. Ejecutar npm run dev en el contenedor app 3. Acceder a http://app.localhost 4. Comprobar en las herramientas de desarrollo del navegador que la cookie XSRF-TOKEN se ha establecido...

Larascript

| | | | | | / || '| / |/ | /|| ' || || ' \ | | | | | | || | | | | | | | | || | || | || , ||| ,|| / ||| ||| ./ | || 作者：@pwnedshell & @rsgbengi 📌 Larascript 是什么？ Larascript 是一个利用 CVE-2018-15133 漏洞的脚本，如果存在漏洞的 Laravel 应用暴露在外，它可以执行远程命令。你可以发送命令并获取响应，例如获取 cat /etc/passwd。但你也可以请求获取一个 shell，它会为你建立一个反向...

vertx-web-xsrf

概述 io.vertx.ext.web.handler.impl.CSRFHandlerImpl 中的 CSRFHandlerImpl（在 Vert.x Web 中）不会为每个用户会话创建唯一的 CSRF Token。恶意网站仍然可以通过获取有效的 CSRF Token 并将其添加到 HTML 表单中，然后向易受攻击的 Web 应用程序提交表单来执行 CSRF。 目前，预检 CORS OPTIONS HTTP 请求可以通过 XMLHTTPRequests 防止 CSRF，但可能存在绕过预检请求的方法。 构建 mvn clean package 测试 应用程序启动 HTTP 端点： 端口...

Lab-for-cve-2018-15133

摘要： 利用CVE-2018-15133反序列化漏洞 此利用针对Laravel框架5.5.40及5.6.x至5.6.29版本中的反序列化漏洞。 描述 远程代码执行可能源于对潜在不可信的X-XSRF-TOKEN值进行unserialize调用。这涉及Illuminate/Encryption/Encrypter.php中的decrypt方法以及phpggc中gadgetchains/Laravel/RCE/3/chain.php的PendingBroadcast。攻击者必须知道应用密钥，正常情况下这不会发生，但如果攻击者之前拥有特权访问权限或成功完成了之前的攻击，则可能发生。 前提条件...

Malicious code in radio-player-theme (npm)

radio-player-theme presents itself as a radio player theme. The published tarball contains three files: package.json, style.css declared as main and payload.js, which holds the package's only executable code. payload.js is a browser payload. On execution it reads location.origin and...

CVE-2026-54694: Improper Input Validation

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. StringHighlighter.js builds an HTML string by interpolating raw value substrings...

Security Bulletin:IBM Spectrum Control is vulnerable to weaknesses related to axios (CVE-2026-42033, CVE-2026-42034, CVE-2026-42035, CVE-2026-42036, CVE-2026-42037, CVE-2026-42038, CVE-2026-42039, CVE-2026-42040, CVE-2026-42041, CVE-2026-42042, CVE-2026)

Summary Axios is vulnerable to Prototype Pollution / Transport Hijacking ,HTTP Request/Response Splitting via Gadget ,NOPROXY Protection Bypass ,Denial of Service DoS via Uncontrolled Recursion ,SSRF via Incomplete Proxy Bypass ,JSON API Response Manipulation via Prototype Pollution,XSRF Token...

Important: python3.13-tornado

Issue Overview: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, authusername, authpassword, and authmode in place when a redirect changed scheme...

CVE-2026-49854

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocketmask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided...

UBUNTU-CVE-2026-49854

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocketmask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided...

CVE-2026-49854 Tornado: Out-of-bounds memory access in C extension

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocketmask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided...

EUVD-2026-44504

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocketmask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided...

CVE-2026-49854: Buffer Over-read

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, the optional native extension tornado.speedups implemented websocketmask without validating that the mask argument is exactly four bytes, allowing the C function to read up to three bytes beyond the provided...

JupyterLab vulnerable to potential authentication and CSRF tokens leak

ImpactUsers of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server version. PatchesJupyterLab 4.1.0b2, 4.0.11, and 3.6.7 were patched. WorkaroundsNo workaround has been identified, however users...

PYSEC-2026-2534 JupyterLab vulnerable to potential authentication and CSRF tokens leak

Impact Users of JupyterLab who click on a malicious link may get their Authorization and XSRFToken tokens exposed to a third party when running an older jupyter-server version. Patches JupyterLab 4.1.0b2, 4.0.11, and 3.6.7 were patched. Workarounds No workaround has been identified, however users...

Siemens RUGGEDCOM RST2428P Insertion of Sensitive Information Into Sent Data (CVE-2025-66035)

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential...

Axios: Regular Expression Denial of Service (ReDoS) via Cookie Name Injection

Summary Axios versions before 0.32.0 on the 0.x line and before 1.16.0 on the 1.x line build a regular expression from the configured XSRF cookie name without escaping regex metacharacters. In standard browser environments, an attacker who can influence the cookie name passed to axios can cause...

GHSA-XX6V-RP6X-Q39C Axios: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in `withXSRFToken` Boolean Coercion

Vulnerability Disclosure: XSRF Token Cross-Origin Leakage via Prototype Pollution Gadget in withXSRFToken Boolean Coercion Summary The Axios library's XSRF token protection logic uses JavaScript truthy/falsy semantics instead of strict boolean comparison for the withXSRFToken config property. Whe...