Original research, in public.
Writeups of vulnerabilities Cipher found in widely deployed software, and field reports from the engagements we run.
The reference that outlived its task: a use-after-free in strongSwan's IKEv2 rekeying
strongSwan's IKEv2 rekey-collision handling caches a raw pointer to a task it does not own. An authenticated peer can make the task manager free that task, then deliver a delayed response that dereferences the dangling pointer for an indirect call.
All posts
Newest firstThe reference that outlived its task: a use-after-free in strongSwan's IKEv2 rekeying
strongSwan's IKEv2 rekey-collision handling caches a raw pointer to a task it does not own. An authenticated peer can make the task manager free that task, then deliver a delayed response that dereferences the dangling pointer for an indirect call.
Declared on the interface, dropped on the override: an authorization bypass in OpenMRS FHIR2
FHIR2 declares its read privileges as annotations on DAO interfaces. Where a concrete class overrides one of those methods, the annotation lookup lands on the override, which carries none, and the privilege check is skipped.
The comment cited the limit: an unbounded write from one Router Advertisement in Zephyr
Zephyr's IPv6 stack takes an 8-bit context length straight from a Router Advertisement and never bounds it to the RFC's 128. One packet from any on-link host underflows a memset length and zeroes memory far past a 16-byte buffer.
Parameterized everywhere but the sort: a SQL injection in OpenEMR's Fee Sheet
OpenEMR's Fee Sheet inventory query uses bind parameters for its values, but the sort target, which a parameter can't fill, is built from a request field by string interpolation. A low-privileged clinical user injects there and reads the whole database, including password hashes.
Blocked in one spelling: a peer-ACL bypass on coturn's TCP relay path
coturn's denied-peer-ip list recognized one way of writing an IPv4 address inside an IPv6 address. Written any of the other ways, the same denied destination passed the check and the relay connected to it.
Filtered on every path but one: a row-permission bypass in Hasura's computed fields
A Hasura computed field returning SETOF a table inherits that table's row permissions on selection, relationships, and aggregations. On one path, a where-clause over the field, the filter is dropped, turning it into a boolean oracle for hidden rows.
Privileged and unqualified: a tenant-to-pod RCE in StackGres's metrics exporter
StackGres's bundled metrics exporter opens superuser sessions into every tenant database and runs unqualified catalog SQL with no search_path pinning, so a tenant database owner can shadow a function and reach OS command execution in the primary Postgres pod.
Bounded against the wrong buffer: a heap over-read in 7-Zip's ext handler
7-Zip parses ext2/3/4 disk images by content. One attacker-controlled superblock field drives the inode-bitmap scan past a fixed-size buffer: a heap out-of-bounds read that crashes the process the moment an untrusted image is listed or extracted.
Checked on state, skipped on diff: a presence authorization gap in Supabase Realtime
Supabase Realtime enforces a presence.read policy on the initial presence snapshot but not on the ongoing presence_diff fan-out, so a member allowed to broadcast but denied presence can still read every other member's presence metadata on a private channel.
A two-decade-old heap overflow in GraphicsMagick's PCD decoder
GraphicsMagick ported ImageMagick's out-of-bounds read fix for the PCD decoder but not the write-side bound that shipped alongside it, leaving an attacker-controlled heap overflow in DecodeImage: the un-ported other half of the same hardening.
Minting wallet money from the open internet
A consumer fintech asked Cipher to extend a review into its infrastructure. Modeling the wallet's request flow end to end surfaced an internal money-crediting endpoint reachable, unauthenticated, from the open internet (proven with a reverted credit).
Bound on revoke, unbound on redemption: an OAuth client-binding flaw in ZITADEL
ZITADEL's OAuth token endpoint authenticated the calling client but never checked that the grant it was redeeming had been issued to that client. The same binding check already existed on the revoke path. One missing invariant, spanning three grant types and token exchange.
Seven vulnerabilities in Vim, from crashes to code execution
Seven memory-safety and code-execution flaws Cipher reported in Vim, from spell-file and soundfold crashes to command injection in netrw and arbitrary code execution in C omni-completion. All fixed upstream; one had sat in the spell code since 2006.
A pre-auth crash in the 5G core: out-of-bounds read in Open5GS
Cipher reported a pre-authentication out-of-bounds read in Open5GS, the open-source 5G core. One malformed NAS message reaches the AMF before authentication and crashes it, taking service down for every connected subscriber.
One auth flaw to full payout control: chaining five bugs in a payments platform
A field report from a cross-border payments engagement. Five findings, each a routine medium on its own, chain from an anonymous Internet request to direct money movement. The work was reading them together.