Blogs
OPNsense: LDAP Injection via Unsanitized Login Username
OPNsense is a popular open-source firewall and routing platform built on FreeBSD. It handles network perimeter security for a huge range of environments, from home labs to enterprise edge routers, and it supports LDAP and Active Directory integration for centralized authentication. That makes the …
Three Security Findings in Tautulli: SSRF, JSONP Injection, and SQL Injection
Background Tautulli is a Python/CherryPy web application that sits alongside your Plex Media Server and gives you statistics, notifications, and monitoring for everything happening on your server. It is one of the most popular self-hosted Plex companion apps, and a lot of people run it exposed on …
Finding a Svelte SSR XSS via Unsanitized idPrefix in HTML Comment Markers
Background I’ve been working through Vercel’s bug bounty program, which explicitly calls out server-side rendering and compiler security as focus areas. Svelte is a Tier 1 target in that program, and since Svelte 5 introduced a significant rework of how components are compiled and …
AdGuardHome: Unauthenticated API Access via HTTP/2 Cleartext (h2c) Upgrade
AdGuardHome is a self-hosted DNS-level ad blocker that a lot of people, myself included, run on their home networks. It sits in front of all your DNS traffic and blocks ads, trackers, and malware domains before they even get a chance to load. It is common on home routers, Raspberry Pis, and small …
Unauthenticated SSRF in RustDesk Lets Anyone Port-Scan Your Internal Network
Background RustDesk is an open-source remote desktop tool written in Rust. It is basically the self-hosted alternative to TeamViewer or AnyDesk, and it has gotten pretty popular because you can run your own relay and rendezvous server. That self-hosted server model is actually the interesting part …
Open Redirect in Prowlarr Login Lets Attackers Redirect Users After Authentication
Background Prowlarr is an open-source indexer manager for the *arr ecosystem (Radarr, Sonarr, Lidarr, etc.). It acts as a centralized proxy for torrent and Usenet indexers, so a typical homelab setup has it sitting alongside a media server stack with direct access to download clients and a lot of …
