Original research, in public.
Writeups of vulnerabilities Cipher found in widely deployed software, and field reports from the engagements we run.
Eight vulnerabilities in BusyBox
Cipher found eight vulnerabilities in BusyBox. The most serious lets an unauthenticated client crash the TLS server on the first handshake message. Others overflow the heap from a crafted filesystem image and accept a stored password hash as the password.
All posts
Newest firstEight vulnerabilities in BusyBox
Cipher found eight vulnerabilities in BusyBox. The most serious lets an unauthenticated client crash the TLS server on the first handshake message. Others overflow the heap from a crafted filesystem image and accept a stored password hash as the password.
An authenticated peer stalls an IKEv2 rekey and drives strongSwan through freed memory
strongSwan's IKEv2 rekey-collision handling caches a raw pointer to a task it does not own. An authenticated peer can make the task manager free that task, then deliver a delayed response that dereferences the dangling pointer for an indirect call.
A zero-privilege OpenMRS account could still read patient observations over FHIR
FHIR2 declares its read privileges as annotations on DAO interfaces. Where a concrete class overrides one of those methods, the annotation lookup lands on the override, which carries none, and the privilege check is skipped.
One Router Advertisement on the local link drives an unbounded write in Zephyr
Zephyr's IPv6 stack takes an 8-bit context length straight from a Router Advertisement and never bounds it to the RFC's 128. One packet from any on-link host underflows a memset length and zeroes memory far past a 16-byte buffer.
From a nurse-level login to full database extraction in OpenEMR
OpenEMR's Fee Sheet inventory query uses bind parameters for its values, but the sort target, which a parameter can't fill, is built from a request field by string interpolation. A low-privileged clinical user injects there and reads the whole database, including password hashes.
From one visited web page to remote code execution in Eclipse Theia
Eclipse Theia's browser backend enforces its connection token only on the WebSocket upgrade, leaving every HTTP route open. A page the victim merely visits can POST to /file-upload and write files anywhere the backend can reach, up to code execution on the host.
IPv6 translation reaches ACL-blocked internal destinations through coturn
coturn's denied-peer-ip list recognized one way of writing an IPv4 address inside an IPv6 address. Written any of the other ways, the same denied destination passed the check and the relay connected to it.
Hidden rows, exposed values: inference through Hasura's computed-field filters
A Hasura computed field returning SETOF a table inherits that table's row permissions on selection, relationships, and aggregations. On one path, a where-clause over the field, the filter is dropped, turning it into a boolean oracle for hidden rows.
From tenant database owner to OS command execution in StackGres
StackGres's bundled metrics exporter opens superuser sessions into every tenant database and runs unqualified catalog SQL with no search_path pinning, so a tenant database owner can shadow a function and reach OS command execution in the primary Postgres pod.
Just listing a crafted ext2/3/4 image triggers a heap over-read in 7-Zip
7-Zip parses ext2/3/4 disk images by content. One attacker-controlled superblock field drives the inode-bitmap scan past a fixed-size buffer: a heap out-of-bounds read that crashes the process the moment an untrusted image is listed or extracted.
Supabase Realtime delivered presence updates despite an explicit read denial
Supabase Realtime enforces a presence.read policy on the initial presence snapshot but not on the ongoing presence_diff fan-out, so a member allowed to broadcast but denied presence can still read every other member's presence metadata on a private channel.
A two-decade-old heap overflow in GraphicsMagick's PCD decoder
GraphicsMagick ported ImageMagick's out-of-bounds read fix for the PCD decoder but not the write-side bound that shipped alongside it, leaving an attacker-controlled heap overflow in DecodeImage: the un-ported other half of the same hardening.
Minting wallet money from the open internet
A consumer fintech asked Cipher to extend a review into its infrastructure. Modeling the wallet's request flow end to end surfaced an internal money-crediting endpoint reachable, unauthenticated, from the open internet (proven with a reverted credit).
ZITADEL let one OAuth client redeem codes and tokens issued to another
ZITADEL's OAuth token endpoint authenticated the calling client but never checked that the grant it was redeeming had been issued to that client. The same binding check already existed on the revoke path. One missing invariant, spanning three grant types and token exchange.
Seven vulnerabilities in Vim, from crashes to code execution
Seven memory-safety and code-execution flaws Cipher reported in Vim, from spell-file and soundfold crashes to command injection in netrw and arbitrary code execution in C omni-completion. All fixed upstream; one had sat in the spell code since 2006.
One unauthenticated NAS message triggers an out-of-bounds read in Open5GS's 5G core
Cipher reported a pre-authentication out-of-bounds read in Open5GS, the open-source 5G core. One malformed NAS message reaches the AMF before authentication and crashes it, taking service down for every connected subscriber.
One auth flaw to full payout control: chaining five bugs in a payments platform
A field report from a cross-border payments engagement. Five findings, each a routine medium on its own, chain from an anonymous Internet request to direct money movement. The work was reading them together.