Home on aniket/awwfensive

Breaking Flyto's MCP Recipe Runner: A Path Traversal Vulnerability

Tue, 14 Jul 2026 00:00:00 +0000

What is flyto-core?

Flyto Core is the core execution engine of the Flyto platform that runs automation workflows by orchestrating modules, managing execution state, handling variables and secrets, and recording evidence throughout the workflow lifecycle.

What are Flyto recipes?

Flyto supports reusable, pre-built YAML workflows called recipes. They are intended to live in the bundled src/recipes/ directory, be listed through list_recipes(), and be executed by name through the CLI or MCP run_recipe tool.

React2Shell: CVE-2025-55182 Technical Analysis

Sat, 20 Dec 2025 11:51:55 +0530

Executive Summary

The Threat: CVE-2025-55182 is a critical remote code execution vulnerability in React Server Components that allows unauthenticated attackers to execute arbitrary code on servers through a single malicious HTTP request. No credentials, no user interaction, no special configuration required.

What is it? An unsafe deserialization vulnerability in React’s Flight protocol that allows prototype chain traversal to access dangerous Node.js built-ins like child_process and vm.

Prerequisites: Understanding React’s Rendering Models

To understand how CVE-2025-55182 works, you first need to understand how React evolved from client-side rendering to Server Components. Let’s build this foundation.

Container Escape: From Enumeration to Host Root

Mon, 10 Nov 2025 11:51:55 +0530

Containers have become the backbone of modern infrastructure, powering everything from microservices to CI/CD pipelines. But here’s the uncomfortable truth: containers are not virtual machines. They’re processes with fancy namespaces and cgroups, sharing the same kernel as the host. This fundamental architecture creates a fascinating attack surface for security researchers and red teamers.

TL;DR: The One-Minute Version

If you only have sixty seconds, here’s what you need to know about container escapes:

Breaking Authentication: Bcrypt Truncation & Email Normalization

Sat, 25 Oct 2025 11:51:55 +0530

Introduction

During ImaginaryCTF 2025, I tackled a very fascinating web challenge called “passwordless” that showcased how multiple subtle implementation flaws can combine to create a critical authentication bypass. The challenge presented a Node.js authentication system where users register with their email and receive a randomly generated temporary password—except the password delivery mechanism was never implemented.

What made this challenge particularly interesting is that every security component appeared properly implemented at first glance: bcrypt for password hashing, email normalization to prevent duplicates, input validation, and rate limiting. However, the devil was in the details. The interaction between bcrypt’s 72-byte truncation limit, inconsistent email processing, and user-controlled password components created a perfect exploit chain allowing complete authentication bypass.

Exploiting Symlink Upload and Session Forgery

Mon, 01 Sep 2025 00:00:00 +0000

Introduction

During TFC 2025 CTF, I encountered a fascinating web challenge that showcased how multiple seemingly minor vulnerabilities can be chained together to achieve complete system compromise. The application appeared simple on the surface: upload a ZIP file, extract it, and serve the contents for download. However, beneath this straightforward functionality lurked a perfect storm of security issues.

This writeup demonstrates a complete exploit chain combining symlink traversal, path traversal, session forgery, and authentication bypass. What makes this particularly interesting is how each vulnerability alone might seem insignificant, but together they create a devastating attack vector.

Exploiting CVE-2025-29744: When Prepared Statements Aren't Safe

Sat, 02 Aug 2025 00:00:00 +0000

This post analyzes a subtle SQL injection vulnerability — CVE-2025-29744 — in pg-promise, a popular PostgreSQL library for Node.js built on top of node-postgres.

Discovered by the Sonar team, this flaw affects how pg-promise handles certain prepared statements when using the simple query protocol. Under specific conditions, it may allow attackers to inject SQL—even if first-party code uses parameterized queries.

Exploitation requires:

Use of prepared statements in a particular structure.
Use of the simple query protocol instead of the extended one.

Vulnerability Details

The vulnerability involved injecting inline comments in a situation where subtraction from a value was possible, such as:

Projects

Mon, 01 Jan 0001 00:00:00 +0000

A few security projects and labs I keep within reach.