Simon Koeck
Security researcher and developer. I find vulnerabilities
and write about them.
Recent writeups
How I Found a $90,000 Remote Code Execution Vulnerability in Google
A Flask cookie on developers.google.com was signed with a secret it was also carrying inside itself. Pulling that secret out turned a forged session into code execution across seven Google domains.
A Single POST Freezes Any Next.js Server
To rebuild one submitted form, React scanned every field in the request once for each reference it contained. Nothing capped either number, so one 900 KB POST makes the server do 100 million checks and freeze.
From a Schema Name to RCE in n8n
n8n uses a user-supplied schema name as a bare object key. Set it to __proto__, pollute the prototype, chain into RCE via the Git node.
One Uppercase Letter Breaks Every Nuxt App
h3 powers every Nuxt app but only recognized 'chunked' in lowercase. Send 'ChunKed' instead and you get request smuggling.
Reading /etc/passwd via Translation Upload in Tolgee
Tolgee's XML translation importers ship with zero security config. Upload a crafted file, read anything from the server. Confirmed on their cloud platform.