$ filter --tag rce

AST Injection through Pug

A detailed lab note on turning Prototype Pollution into code execution through Pug's AST/code-generation path: vulnerable merge, prototype chain behavior, debugger observations, exploit shape, trigger conditions and defenses.

2026-05-17

CVE-2025-54309: CrushFTP AS2 Auth Bypass to Unauthenticated RCE

A full breakdown of CVE-2025-54309 — the CrushFTP zero-day exploited in the wild in July 2025. A logic flaw in loginCheckHeaderAuth() lets a crafted AS2-To header skip authentication entirely, after which an attacker creates an admin account, remaps the Virtual File System to the OS root, drops a malicious Java plugin and reaches remote command execution. Root cause, the bypass-to-RCE kill chain, detection IOCs and remediation.

2025-08-02