Andrew Leonov

Web Application Security Researcher

[Andrew Leonov @4lemon]

@Facebook #ImageTragick remote code execution https://t.co/Rk3Qtax3ZD #RCE #BugBounty

[Andrew Leonov @4lemon]

p.s. the two legends who once spent 34 min breaking this bug down on YouTube: @Jhaddix and @yaworsk. they could've just asked 😉 https://t.co/uACLnT6nxS

[Andrew Leonov @4lemon]

10 years ago I turned one image into code execution on Facebook. By hand. $40k, their biggest bounty at the time.

Back when grass was greener and bugs were found by humans. Now @xbow runs the leaderboards.

So I let the AI cut the nostalgia reel. 👇
#ImageTragick

[Andrew Leonov @4lemon]

@sightmachine How can I report a security issue to you?

Thank you in advance!

[Andrew Leonov @4lemon]

@centilytics Hello, How can I report a security issue to you?

Thank you in advance!

[Andrew Leonov @4lemon]

@Barclays How can I report a security issue to you?
Thank you in advance!

[Andrew Leonov @4lemon]

@bananabr @wcbowling @Agarri_FR @iamnoooob @dozernz Challenge accepted:) Zip and EIP are solved, jpg/png/tiff are stronger than me right now.

[Andrew Leonov @4lemon]

Ha! This is fashionable this week) Two different vectors for CVE-2021-22204 and... no idea about embedding into a jpg file.

[Andrew Leonov @4lemon]

@Raiffeisen_Ru Заранее спасибо за ответ на вопрос выше, который я задал 6 октября.

[Andrew Leonov @4lemon]

@Raiffeisen_Ru, добрый день! А то что карты выдаются без конвертов и любой желающий может переписать реквизиты по пути от неизвестного мне места хранения до стола сотрудника это как? Я, конечно, PCI DSS наизусть не помню. Но странно как-то.

[Andrew Leonov @4lemon]

Только давайте попытаемся избежать подобных пассажей:)

[Сбер @sberbank]

@a_okshus Да, логин и пароль не чувствительны к регистру, чтобы пользователям было удобнее. Не переживайте, это безопасно.

[Andrew Leonov @4lemon]

@a66ot @i_bo0om @acunetix @leonov_av I have no goodies=) Sir, give me some money plz =)) I have spent a lot of time while testing ur service, the reward is needed!

[Andrew Leonov @4lemon]

@a66ot @i_bo0om @acunetix @leonov_av Yes and no:) You're right from some point of view. This is a result of cross-marketing activities. But the issue is real:)

[Andrew Leonov @4lemon]

@omespino @intigriti @fin1te Good luck=)

[Andrew Leonov @4lemon]

@HusseiN98D @Sp_L_aT That's not a secret, but the scope is defined in BBP policy ;)

[Andrew Leonov @4lemon]

@Unilever hi, how to report security issue to Unilever?

[Andrew Leonov @4lemon]

@Nestle hi, how to report security issue to Nestle?

[Andrew Leonov @4lemon]

@PwC hi, how to report security issue to PwC?

[Andrew Leonov @4lemon]

@radware Got it. Thank you.

[Andrew Leonov @4lemon]

@radware hi, how to report security issue to Radware?

[Andrew Leonov @4lemon]

@LVServices hi, how to report security issue to LV?

[Andrew Leonov @4lemon]

@CGI_USA hi, how to report security issue to CGI?