@Creastery

www = web web web · Senior Information Security Engineer @GoogleVRP · Previously @praetorianlabs & @starlabs_sg · Opinions are my own.

 Singapore
creastery.com
Joined May 2012
  • Tweets115
  • Following540
  • Followers1.1K
5Media
Check out my write-up on a seemingly harmless and limited send() in GitHub (CVE-2024-0200) and how it could be used to obtain environment variables from a production container and to achieve remote code execution in GitHub Enterprise Server: starlabs.sg/blog/2024/04-sen…
5
82
5
240
40,239
Happy to announce that I'll be speaking alongside @DennisPacewicz at @rubykaigi next week! We'll be sharing some secret stories on how I gained access to production GitHub credentials using CVE-2024-0200 as well as @GitHubSecurity's remediation efforts. rubykaigi.org/2025/presentat…

Keeping Secrets: Lessons Learned From Securing GitHub

rubykaigi.org
1
1
6
531
Ngo Wei Lin retweeted
Luke Jahnke@lukejahnke25 Nov 2024
I just published a new blog post sharing an improved Deserialization Gadget Chain for Ruby! It builds on the work of others, including Leonardo Giovanni, Peter Stöckli @GHSecurityLab and @wcbowling nastystereo.com/security/rub…
2
61
2
201
26,164
Thrilled to release my latest research on Apache HTTP Server, revealing several architectural issues! blog.orange.tw/2024/08/confu… Highlights include: ⚡ Escaping from DocumentRoot to System Root ⚡ Bypassing built-in ACL/Auth with just a '?' ⚡ Turning XSS into RCE with legacy code from 1996
37
648
36
1,902
240,012
🚨 New Blog Alert! 🚨 Can an attacker execute commands by sending JSON? Learn how unsafe deserialization vulnerabilities in Ruby can be exploited and how they can be detected with CodeQL. 🔗 Read the full post: github.blog/2024-06-20-execu… Stay safe and code responsibly! 🛡️💻

Execute commands by sending JSON? Learn how unsafe deserialization vulnerabilities work in Ruby...

Can an attacker execute arbitrary commands on a remote server just by sending JSON? Yes, if the running code contains unsafe deserialization vulnerabilities. But how is that possible? In this blog...

github.blog
20
46
5,014
Ngo Wei Lin retweeted
shubs
@infosec_au9 May 2024
My colleague @hash_kitten and I discovered a full-read SSRF vulnerability in Next.js (CVE-2024-34351). We published our research today on @assetnote's blog: assetnote.io/resources/resea…. Thank you to the Vercel team for a smooth disclosure process.
16
181
8
776
95,682
Ngo Wei Lin retweeted
Adnan Khan@adnanthekhan6 May 2024
Here is my deep-dive post on #github Actions cache poisoning. This is a powerful build pipeline lateral movement and privilege escalation technique and I used it to earn several thousand💰in #bugbounty rewards. adnanthekhan.com/2024/05/06/…

The Monsters in Your Build Cache - GitHub Actions Cache Poisoning | Adnan Khan - Security Research

The Monsters in Your Build Cache - GitHub Actions Cache Poisoning - Security research by adnanthekhan

adnanthekhan.com
3
25
1
89
6,675
Ngo Wei Lin retweeted
starlabs@starlabs_sg6 May 2024
Send()-ing Myself Belated Christmas Gifts - GitHub's Environment Variables & GHES Shell starlabs.sg/blog/2024/04-sen… Read about how one of our talented researchers, @Creastery , found it, exploited it and reported it in a fast and professional manner:
1
20
3
101
12,098
Huge thanks to @GitHubSecurity for coordinating, investigating and fixing!
5
1,437
Ngo Wei Lin retweeted
joernchen@joernchen3 May 2024
Earlier this year I found a pretty cool vuln, an arbitrary file write in GitLab. Here’s the details gitlab-com.gitlab.io/gl-secu…
3
46
1
151
27,052
Ngo Wei Lin retweeted
starlabs@starlabs_sg18 Mar 2024
Route to Safety: Navigating Router Pitfalls is the swansong from @daniellimws starlabs.sg/blog/2024/route-… We hope everyone enjoyed his informative post and wish him all the best in his future endeavours.
2
29
60
12,920
Off-by-One 2024 Conference CFP is now opened! Be part of a historical event and shape the future of offensive security in this region. Submission and speaker benefits offbyone.sg/cfp/ If you like to talk to us, drop us a line at [email protected]
18
2
33
8,425
👀
CVE@CVEnew16 Jan 2024
CVE-2024-0200 An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of… cve.org/CVERecord?id=CVE-202…
1
11
1,889
This is one of the most insane bugs I've discovered, but it all happened at a really inopportune time. 😥 Shoutout to all the Hubbers who got involved and had been working tirelessly on this since the Christmas/New Year period! 🙏
GitHub Security@GitHubSecurity16 Jan 2024
We received a bug bounty report of a vulnerability which, if exploited, allowed access to credentials within a production container. We have patched GitHub.com and rotated all affected credentials, and patches for GHES are available today. github.blog/2024-01-16-rotat…
57
5,452
Special thanks to @chudypb, @TecR0c, @mr_me, @Creastery, @starlabs_sg, @Claroty & #team82, and @thezdi for finding & responsibly disclosing security vulnerabilities in Ignition. Fixes & full credits: bit.ly/4aytnlq

Tech Advisory: Regarding the Security Advisories Published by the ZDI on 8 August 2023

Regarding the Security Advisories Published by the ZDI on 8 August 2023 On August 8th, 2023, Trend Micro’s Zero Day Initiative (ZDI), the organizers of ICS Pwn2Own, published six security advisorie...

support.inductiveautomation.com
1
3
11
2,798
Check out the technical analysis of 10 remote code execution bugs I discovered in Chamilo LMS below⬇️.
starlabs@starlabs_sg28 Nov 2023
Several Chamilo RCE detailed analysis from our team member, @Creastery Patches available since September 2023. starlabs.sg/advisories/23/23… starlabs.sg/advisories/23/23… starlabs.sg/advisories/23/23… starlabs.sg/advisories/23/23… starlabs.sg/advisories/23/23… starlabs.sg/advisories/23/23…

(CVE-2023-4220) Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

Summary Product Chamilo Vendor Chamilo Severity High - Adversaries may exploit software vulnerabilities to obtain unauthenticated remote code execution. Affected Versions <= v1.11.24 Tested Versions...

starlabs.sg
2
1
15
3,964
Unauthenticated RCE: starlabs.sg/advisories/23/23… starlabs.sg/advisories/23/23… starlabs.sg/advisories/23/23… starlabs.sg/advisories/23/23… Authenticated RCE: starlabs.sg/advisories/23/23… starlabs.sg/advisories/23/23… starlabs.sg/advisories/23/23… starlabs.sg/advisories/23/23… starlabs.sg/advisories/23/23… starlabs.sg/advisories/23/23…

(CVE-2023-3368) Chamilo LMS Unauthenticated Command Injection

Summary Product Chamilo Vendor Chamilo Severity High - Adversaries may exploit software vulnerabilities to obtain unauthenticated remote code execution. Affected Versions <= v1.11.20 Tested Versions...

starlabs.sg
1
2
4
805
Notably, CVE-2023-3368 I discovered is a patch bypass of CVE-2023-34960 (unauthenticated command injection bug exploited in-the-wild found by @RandoriSec/@Aituglo), and CVE-2023-3533 is another unauthenticated file write RCE found in the same code location that was overlooked!🙈
3
371
Check out this detailed n-day writeup by @oceankex, a former web security intern at STAR Labs I mentored, and how it led to two other bugs hidden in plain sight being discovered!
starlabs@starlabs_sg29 Sep 2023
Our team member, @Creastery , & our former intern, @oceankex, prepared this some time ago. "Analysis of NodeBB Account Takeover Vulnerability (CVE-2022-46164)" starlabs.sg/blog/2023/09-ana… While writing this, they found another bug starlabs.sg/advisories/23/23… We hope you enjoy it

Analysis of NodeBB Account Takeover Vulnerability (CVE-2022-46164)

Back in January 2023, I tasked one of our web security interns, River Koh (@oceankex), to perform n-day analysis of CVE-2022-46164 as part of his internship with STAR Labs. The overall goal is to...

starlabs.sg
1
7
1,328
Ngo Wei Lin retweeted
Jia Hao@Chocologicall31 Aug 2023
I've finally published the advisories regarding the Trend Micro bugs that I shared at #HITCON! Do check them out at @starlabs_sg's advisory page: starlabs.sg/advisories/ 🏌️‍♂️CVE-2023-32530 is an interesting case of SQLi to RCE: starlabs.sg/advisories/23/23…

Advisories

CVE advisories and vulnerability reports published by STAR Labs.

starlabs.sg
41
4
164
79,696
Load more