Ngo Wei Lin

www = web web web · Staff Security Engineer @praetorianlabs · Previously 🌐 Security Researcher @starlabs_sg · Plays CTFs with HATS SG. Opinions are my own.

[Ngo Wei Lin @Creastery]

Check out my write-up on a seemingly harmless and limited send() in GitHub (CVE-2024-0200) and how it could be used to obtain environment variables from a production container and to achieve remote code execution in GitHub Enterprise Server:

https://t.co/jmjTTOxEGY

[Ngo Wei Lin @Creastery]

@ttaka_66 @DennisPacewicz @rubykaigi @GitHubSecurity Hi @ttaka_66, thanks for enjoying the talk! The slides/resources are available at https://t.co/XcLlQsG4Ub.

[Ngo Wei Lin @Creastery]

Happy to announce that I'll be speaking alongside @DennisPacewicz at @rubykaigi next week!

We'll be sharing some secret stories on how I gained access to production GitHub credentials using CVE-2024-0200 as well as @GitHubSecurity's remediation efforts.

https://t.co/zIHyfJ7vqZ

[Luke Jahnke @lukejahnke]

I just published a new blog post sharing an improved Deserialization Gadget Chain for Ruby!

It builds on the work of others, including Leonardo Giovanni, Peter Stöckli @GHSecurityLab and @wcbowling

https://t.co/mzXQnA691O

[Orange Tsai 🍊 @orange_8361]

Thrilled to release my latest research on Apache HTTP Server, revealing several architectural issues! https://t.co/7ygwWXY0pd

Highlights include:
⚡ Escaping from DocumentRoot to System Root
⚡ Bypassing built-in ACL/Auth with just a '?'
⚡ Turning XSS into RCE with legacy code from 1996

[GitHub Security Lab @GHSecurityLab]

🚨 New Blog Alert! 🚨
Can an attacker execute commands by sending JSON? Learn how unsafe deserialization vulnerabilities in Ruby can be exploited and how they can be detected with CodeQL.
🔗 Read the full post: https://t.co/tdumVwrfKC
Stay safe and code responsibly! 🛡️💻

[shubs @infosec_au]

My colleague @hash_kitten and I discovered a full-read SSRF vulnerability in Next.js (CVE-2024-34351). We published our research today on @assetnote's blog: https://t.co/pUXGG64B0O. Thank you to the Vercel team for a smooth disclosure process.

[Adnan Khan @adnanthekhan]

Here is my deep-dive post on #github Actions cache poisoning. This is a powerful build pipeline lateral movement and privilege escalation technique and I used it to earn several thousand💰in #bugbounty rewards.

https://t.co/7S5MjdP2Wc

[starlabs @starlabs_sg]

Send()-ing Myself Belated Christmas Gifts - GitHub's Environment Variables & GHES Shell
https://t.co/g9d3kOA04o

Read about how one of our talented researchers, @Creastery , found it, exploited it and reported it in a fast and professional manner:

[Ngo Wei Lin @Creastery]

Huge thanks to @GitHubSecurity for coordinating, investigating and fixing!

[Ngo Wei Lin @Creastery]

Check out my write-up on a seemingly harmless and limited send() in GitHub (CVE-2024-0200) and how it could be used to obtain environment variables from a production container and to achieve remote code execution in GitHub Enterprise Server:

https://t.co/jmjTTOxEGY

[joernchen @joernchen]

Earlier this year I found a pretty cool vuln, an arbitrary file write in GitLab.

Here’s the details https://t.co/3d0pDxaUEM

[starlabs @starlabs_sg]

Route to Safety: Navigating Router Pitfalls is the swansong from @daniellimws
https://t.co/QOqAkOhHMz

We hope everyone enjoyed his informative post and wish him all the best in his future endeavours.

[Off-By-One Conference @offbyoneconf]

Off-by-One 2024 Conference CFP is now opened! Be part of a historical event and shape the future of offensive security in this region.
Submission and speaker benefits https://t.co/96khe0PVR2
If you like to talk to us, drop us a line at [email protected]

[Ngo Wei Lin @Creastery]

@testanull All the best!

[Ngo Wei Lin @Creastery]

@adnanthekhan Thanks! Yep, code review. A very unexpected bug with a wild story to share at end April!

[Ngo Wei Lin @Creastery]

👀

[CVE @CVEnew]

CVE-2024-0200 An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of… https://t.co/lZu3ul2tNo

[Ngo Wei Lin @Creastery]

@adnanthekhan @infernosec @GitHubSecurity Seconded on fixing this insecure default config -- I've already tried pushing for this multiple times but to no avail.

[Ngo Wei Lin @Creastery]

@joernchen Hey Joern, the current coordinated disclosure date is set at late April 2024. Hope to share more details and insights then!

[Ngo Wei Lin @Creastery]

This is one of the most insane bugs I've discovered, but it all happened at a really inopportune time. 😥

Shoutout to all the Hubbers who got involved and had been working tirelessly on this since the Christmas/New Year period! 🙏

[GitHub Security @GitHubSecurity]

We received a bug bounty report of a vulnerability which, if exploited, allowed access to credentials within a production container. We have patched https://t.co/0iKPk2jtk4 and rotated all affected credentials, and patches for GHES are available today. https://t.co/5youY6yNTA

[Ngo Wei Lin @Creastery]

@albinowax There is still one more duplicate entry for "Compromising F5 BIGIP with Request Smuggling", but other than that, I think you got them all.