elttam.com resources

elttam.com

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-08-04.

RCE 2 API Sec 1 AuthN 1 AuthZ 1 Deser 1 Fuzzing 1 XSS 1

Date Added	Resource	Excerpt
2026-08-04 2026	Cruising for Shells in Flowise - elttam API Sec RCE	Tool for analyzing and exploiting Remote Code Execution (RCE) vulnerabilities in Flowise, a generative AI development platform. It details findings including RCE via pandas in the CSVAgent node, arbitrary file writes in SQL Database Chain and SQLite Record Manager nodes, and bypasses for the `validatePythonCodeForDataFrame` function. The analysis covers multiple CVEs and GHSA identifiers, demonstrating how attackers can leverage insecure Python code execution and TypeORM DataSource initialization to gain shell access.
2026-07-30 2026	Your House Has an FFmpeg Problem - elttam Fuzzing RCE	Writeup detailing an argument injection vulnerability in ffmpeg within Home Assistant. This vulnerability, discovered while searching for attack primitives, allowed for the exfiltration of sensitive files like `/proc/self/environ` by exploiting ffmpeg's pseudo-protocols, including `concat:` and `file:`, to craft synthetic audio headers from binary data. The exploit chain ultimately led to remote code execution by leveraging the exposed `SUPERVISOR_TOKEN`.
2026-06-22 2026	Exploiting Auth0 Defaults in XSS Attacks - elttam AuthN XSS	Writeup detailing how XSS vulnerabilities in applications using Auth0 can be exploited. The article highlights the insecure implicit grant flow, enabled by default in Auth0, and demonstrates how it can be combined with other misconfigurations to pivot across tenant applications. Specifically, it shows how an attacker can leverage XSS to steal access tokens intended for a protected API, facilitating lateral movement within an Auth0 tenant.
2026-06-11 2026	Jupyter Enterprise Gateway - From Notebook to Kubernetes Cluster Admin - elttam AuthZ	Writeup detailing three vulnerabilities found in Jupyter Enterprise Gateway v3.2.3, allowing a notebook user to escalate privileges to full Kubernetes cluster administrator. These vulnerabilities, responsibly disclosed to the Jupyter security team and patched in v3.3.0, enable a user to bypass UID/GID restrictions by providing values with trailing spaces, leading to root execution within kernel pods. Combined with hostPath volume mounts, this allows access to sensitive cluster secrets, mounting host filesystems, and the creation of arbitrary privileged pods, potentially compromising the entire cluster.
2026-04-03 2026	Ruby 2.x Universal RCE Deserialization Gadget Chain \| elttam Deser	Library for universal RCE deserialization in Ruby 2.x, detailing exploitation techniques. This resource describes how to achieve arbitrary command execution by discovering and chaining available gadgets from the standard library, overcoming limitations of previous methods that required specific gems like ActiveSupport and ERB. It covers identifying gadgets that can dynamically load other libraries, including those that partially control the `require` argument, to expand the attack surface and execute system commands.