Node.js Brotli compression hides an RCE
A buffer overflow in Node's built-in Brotli decompressor lets attackers run code by sending compressed data. The fix is already out.
Read the note 1 min read
From the notebook
rce.
2 notes on this topic.
From the notebook
2 notes on this topic.
A buffer overflow in Node's built-in Brotli decompressor lets attackers run code by sending compressed data. The fix is already out.
A researcher found remote code execution in Google's developer portal by exploiting Flask session cookies. The vulnerability chain is textbook insecure deserialization.