PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Audit of Operator Fabric

blog.quarkslab.com | research | #rce | #vulnerability | #docker | #audit | #ostif | #operatorfabric | #lf-energy
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Quarkslab's OSTIF-mandated audit of OperatorFabric, an LF Energy platform: five vulnerabilities include path traversal leading to RCE and Docker escape, a tar-slip attack and file upload flaws.
Published
Collected

Related coverage

vulnerability · blog.quarkslab.com
MbedTLS Security Audit
At the request of the Open Source Technology Improvement Fund (OSTIF), Quarkslab performed a security audit of mbedTLS, evaluating the security of the changes in version 4.0.
vulnerability · wiz.io
[CVE-2026-111497] Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability
Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
vulnerability · bugpwn.com
open62541: Integer Overflow → Heap Overflow → RCE.
Original research: how a 16 bit size field overflow in open62541's custom DataType machinery lets a malicious OPC UA server corrupt a connecting client's heap, up to remote code execution. CVE-2026-116014, CVSS 9.2. Root cause, networked PoC, and the official fix. By BUG|PWN.
research · blog.quarkslab.com
Cortex Security Audit
Quarkslab audited Cortex, a multi-tenant Prometheus time-series store, for OSTIF: seven findings, including tenant impersonation via PushStream gRPC, were identified and all resolved.
research · blog.quarkslab.com
Extending LLVM's BOLT-based Binary Analyser to Validate Stack Variable Initialisation
Quarkslab extended LLVM's BOLT-based binary analyser for OSTIF with a scanner that validates -ftrivial-auto-var-init at the binary level, verifying stack-variable initialisation hardening.
Back