PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

LiquidFiles Vulnerabilities: From Discovery to Disclosure

projectblack.io | research | #vulnerability-research | #ruby | #semgrep | #disclosure | #liquidfiles
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Hunting vulnerabilities in LiquidFiles v4.1.1 with Semgrep: 623 findings, a command injection blocked by shellescape, and the path that still led to impactful bugs before disclosure.
Published
Collected

Related coverage

blog · blog.trailofbits.com
35 more Semgrep rules: infrastructure, supply chain, and Ruby
Trail of Bits published 35 new Semgrep rules (115 total) covering GitHub Actions OIDC gaps, Terraform/Nomad infrastructure issues, and Ruby flaws, plus a deep dive into regex mode and HCL support.
research · projectblack.io
Local AI for Penetration Testing & Research
The author benchmarks four approaches, including Semgrep and fully agentic GLM 5.1 + Strix, against a known PHPIPAM authenticated LFI (CVE-2026-12194), finding the harness matters more than the model.
research · portswigger.net
The Fragile Lock: Novel Bypasses For SAML Authentication
Novel SAML signature-wrapping attacks — attribute pollution, namespace confusion and Void Canonicalization — achieve full authentication bypass in Ruby and PHP libraries, including GitLab Enterprise.
research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
research · depthfirst.com
Behind the GitLab RCE: A depthfirst Journey into the Ruby Ecosystem
The investigation shows how memory-safety flaws in native Ruby gems can become remotely reachable through widely deployed applications such as GitLab. Teams should inventory native-extension dependencies and move self-managed GitLab and Oj installations to fixed releases.
research · depthfirst.com
Going depthfirst: Achieving GitLab RCE via Two Ruby Memory Corruption Vulnerabilities
We chained two memory-safety flaws in Oj, a native Ruby JSON parser used by GitLab's notebook diff renderer, into remote code execution in a Puma worker. The path begins with an attacker-controlled Jupyter notebook and crosses GitLab, ipynbdiff, CRuby, and jemalloc before reaching function-pointer control.
Back