Top all-time · #7830
devcraft.io
Personal blog · devcraft.iosecurity
devcraft.io is a personal blog at devcraft.io about security. Since 2019, 10 different Hacker News readers have linked it 11 times, most often “ExifTool CVE-2021-22204 – Arbitrary Code Execution (2021)”. The last post was in 2022, but the archive is still widely read.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
Commenters link this security blog for posts on a GitLab RCE through an ExifTool end-of-line regex, a TP-Link router admin page, and SerenityOS exploitation. The comments only cite the posts.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
CTF write ups by vakzz
Most-linked posts?
- ExifTool CVE-2021-22204 – Arbitrary Code Execution (2021)3 people · 4 mentions · first linked 2021-05-15
- SerenityOS: Writing a Full Chain Exploit2 people · 2 mentions · first linked 2021-02-12
What Hacker News says?
Practical Gitlab RCE that involved end of line regex in ExifTools: https://devcraft.io/2021/05/04/exiftool-arbitrary-code-execu...
Comment linking /2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html
on “Regex character "$" doesn't mean "end-of-string"”Submitted ExifTool CVE-2021-22204 – Arbitrary Code Execution (2021) as a story · 106 points
HN discussionEven simple regexs can be problematic, e.g. Gitlab RCE bug through ExifTools https://devcraft.io/2021/05/04/exiftool-arbitrary-code-execu... > "a\ > "" > The second quote was not escaped because in the regex $tok =~ /(\\+)$/ the $ will match the end of a string, but also match before a newline at the end of a string, so the code thinks that the quote is being escaped when it’s escaping the newline.
Comment linking /2021/05/04/exiftool-arbitrary-code-execution-cve-2021-22204.html
on “Regex character "$" doesn't mean "end-of-string"”Submitted SerenityOS: Writing a Full Chain Exploit as a story · 86 points
HN discussion>Why not? The install media should be collecting entropy as it does the install, xoring it with a pool of random data built into it, and writing that to disk as part of the install. and during first reboot you image the disk and flash it into millions of routers, resulting in something like https://devcraft.io/posts/2017/07/21/tp-link-archer-c9-admin...
Comment linking /posts/2017/07/21/tp-link-archer-c9-admin-password-reset.html
on “OpenSSH taking minutes to become available, booting takes half an hour (2018)”Submitted ExifTool CVE-2021-22204 – Arbitrary Code Execution as a story · 3 points
HN discussionIf SerenityOS can be a target for exploits then surely OpenBSD can. https://devcraft.io/2021/02/11/serenityos-writing-a-full-cha...
Comment linking /2021/02/11/serenityos-writing-a-full-chain-exploit.html
on “OPNsense and HardenedBSD are parting ways”Submitted Universal Ruby 2.x-3.x deserialisation gadget to achieve RCE as a story · 3 points
HN discussionSubmitted Round Two: An Updated Universal Deserialisation Gadget for Ruby 2.x-3.x as a story · 1 points
HN discussionSubmitted GitHub Gist – Account takeover via open redirect – $10k Bounty as a story · 1 points
HN discussionSubmitted GitHub – RCE via Git option injection (almost) – $20k Bounty as a story · 1 points
HN discussion
