PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2023-39631] Beyond the Bands: Exploiting TiTiler’s Expression Parser for Remote Code Execution

xbow.com | vulnerability | Critical | CVE-2023-39631 | #rce | #vulnerability-research | #python | #code-execution | #titiler | #expression-parser
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A methodical study of TiTiler's expression parser that ends in arbitrary Python code execution on the server, with a bonus arbitrary file read saved for a follow-up post.
CVE
CVE-2023-39631
CVSS
9.8
Published
Collected

Related coverage

vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · crowdstrike.com
CrowdStrike Protects Customers from Threats Delivered via PHP2Shell
The Falcon platform provides out-of-the-box visibility and detection coverage for post-exploitation activities of CVE-2026-109618 and CVE-2026-109619.
research · slcyber.io
More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE
Chaining an unauthenticated bulk import, an in-band XXE, leaked IMS credentials and Groovy execution into full pre-auth RCE on Adobe Experience Manager Cloud.
Critical · vulnerability · xbow.com
Another Byte Bites the Dust - How XBOW Turned a Blind SSRF into a File Reading Oracle
Details how XBOW escalated a blind SSRF in TiTiler into a full arbitrary file read via byte-by-byte exfiltration in a 48-step chain, from OpenAPI recon to the final oracle.
vulnerability · bughunters.google.com
Capturing the Flags of the Internet: Find 0-days in OSS and write scanners to detect them
InternetCTF offers rewards up to $10,000 for bug hunters who discover novel code execution vulnerabilities in open source software and submit matching Tsunami scanner plugin patches.
Back