4 ms·

Looks like a bunch of re worded copies of existing CVE and a few new lower severity things. I only call them low sev because they seem to require the user to do

Looks like a bunch of re worded copies of existing CVE and a few new lower severity things. I only call them low sev because they seem to require the user to do things that are already inherently dangerous. Just my 2 cents from a quick scan. Edit: To be clear still interesting finds. I think with some chaining some of them might be more severe. Like the ovpn one and windows potentially registering vpn app as default open or some protocol opener for a url location like openvpn:// in an I frame and some clever social engineering. Just a random thought

newguy33 3mo ago
Yea, that's what's confusing. some of these are like lower level slop but some are like genuine criticals. Floci, libssh2, c-ares, FFmpeg, and the PHP one are all LEGIT./ The Ghidra one for example, not so much. I cant help but wonder if this was halfway completed research folder and they just published it as is
- andai 3mo ago
  I wonder if LLMs can tell the difference. Maybe it's like back in the day when you had to add "+good -bad" because otherwise it wouldn't know you wanted it to be good.
- smsm42 3mo ago
  PHP one is at best a moderate-level bug in SOAP client which I don't see any realistic way to exploit (the whole convoluted setup in the POC assumes PHP execution access, which begs the question why bother if you already can execute arbitrary code?) - does not look like "genuine critical" at all.
  - newguy33 3mo ago
    Critical is an overstatement but it userland PHP execution does not equate to native process control. There are many situations where an attacker may have constrained PHP execution, gadget execution, template or plugin execution, deserialization reachability, or a sandboxed context, but not arbitrary native code execution or arbitrary memory write. Definitely impactful
    - smsm42 3mo ago
      Security-wise, there's no such thing as constrained PHP execution, at least with the standard PHP engine. The surface is too wide. You still have OS constraints of the user and capabilities and such, but beyond that if you can run PHP code, you can run anything.

newguy33 3mo ago

Yea, that's what's confusing. some of these are like lower level slop but some are like genuine criticals. Floci, libssh2, c-ares, FFmpeg, and the PHP one are all LEGIT./ The Ghidra one for example, not so much. I cant help but wonder if this was halfway completed research folder and they just published it as is

andai 3mo ago
I wonder if LLMs can tell the difference. Maybe it's like back in the day when you had to add "+good -bad" because otherwise it wouldn't know you wanted it to be good.
smsm42 3mo ago
PHP one is at best a moderate-level bug in SOAP client which I don't see any realistic way to exploit (the whole convoluted setup in the POC assumes PHP execution access, which begs the question why bother if you already can execute arbitrary code?) - does not look like "genuine critical" at all.
- newguy33 3mo ago
  Critical is an overstatement but it userland PHP execution does not equate to native process control. There are many situations where an attacker may have constrained PHP execution, gadget execution, template or plugin execution, deserialization reachability, or a sandboxed context, but not arbitrary native code execution or arbitrary memory write. Definitely impactful
  - smsm42 3mo ago
    Security-wise, there's no such thing as constrained PHP execution, at least with the standard PHP engine. The surface is too wide. You still have OS constraints of the user and capabilities and such, but beyond that if you can run PHP code, you can run anything.