Blogs

Finding a Svelte SSR XSS via Unsanitized idPrefix in HTML Comment Markers
Finding a Svelte SSR XSS via Unsanitized idPrefix in HTML Comment Markers

Background I’ve been working through Vercel’s bug bounty program, which explicitly calls out server-side rendering and compiler security as focus areas. Svelte is a Tier 1 target in that program, and since Svelte 5 introduced a significant rework of how components are compiled and …

AdGuardHome: Unauthenticated API Access via HTTP/2 Cleartext (h2c) Upgrade
AdGuardHome: Unauthenticated API Access via HTTP/2 Cleartext (h2c) Upgrade

AdGuardHome is a self-hosted DNS-level ad blocker that a lot of people, myself included, run on their home networks. It sits in front of all your DNS traffic and blocks ads, trackers, and malware domains before they even get a chance to load. It is common on home routers, Raspberry Pis, and small …

Unauthenticated SSRF in RustDesk Lets Anyone Port-Scan Your Internal Network
Unauthenticated SSRF in RustDesk Lets Anyone Port-Scan Your Internal Network

Background RustDesk is an open-source remote desktop tool written in Rust. It is basically the self-hosted alternative to TeamViewer or AnyDesk, and it has gotten pretty popular because you can run your own relay and rendezvous server. That self-hosted server model is actually the interesting part …

Open Redirect in Prowlarr Login Lets Attackers Redirect Users After Authentication
Open Redirect in Prowlarr Login Lets Attackers Redirect Users After Authentication

Background Prowlarr is an open-source indexer manager for the *arr ecosystem (Radarr, Sonarr, Lidarr, etc.). It acts as a centralized proxy for torrent and Usenet indexers, so a typical homelab setup has it sitting alongside a media server stack with direct access to download clients and a lot of …

Finding an Authentication Bypass and Credential Disclosure in Seerr Using Claude and Bitwarden's AI Security Plugins
Finding an Authentication Bypass and Credential Disclosure in Seerr Using Claude and Bitwarden's AI Security Plugins

Background I’ve been running Seerr at home for a while now. It’s a self-hosted media request manager, forked from Jellyseerr/Overseerr, and it’s the kind of app that gets exposed to the internet pretty regularly since family members need to be able to submit requests. That always …

CSS Injection in dashdot's Single-Widget Embed Mode
CSS Injection in dashdot's Single-Widget Embed Mode

If you run a home lab or a self-hosted setup, there is a good chance you have come across dashdot. It is a slick, glassmorphism-style server monitoring dashboard that shows you CPU load, RAM usage, network stats, and more in real time. It also has a handy single-widget embed mode, where you can pull …