Tagged
#Metasploit
4 posts
One CVE, Two Ecosystems: a Kopia RCE Check for Metasploit and Nuclei
CVE-2026-45695 is an argument-injection RCE in Kopia's SFTP ProxyCommand handling. I shipped a detection for it twice — a Metasploit exploit and a Nuclei template — and the two idioms disagree in instructive ways.
ReadMy First Metasploit Module to Land: an Audiobookshelf Auth Bypass
CVE-2025-25205 is an unauthenticated auth bypass in Audiobookshelf caused by matching a whitelist regex against the full request URL — query string and all. Here's the bug, the crash-safe detection module I wrote for it, and what it took to get my first PR merged into the Metasploit Framework.
ReadWriting a Metasploit Module for a Pre-Auth SQLi in an LLM Gateway
How I turned CVE-2026-42208 — a time-based blind SQL injection in LiteLLM's proxy — into a benign, lab-verified Metasploit detection module, and what the Rapid7 review cycle taught me about shipping upstream.
ReadA Header You Were Never Supposed to Send: Detecting the Next.js Middleware Bypass
CVE-2025-29927 lets an external request skip Next.js middleware entirely — and with it every auth check built there — by sending one header the framework only ever meant to talk to itself. Here's the bug, and the Metasploit scanner I wrote to detect it without touching the data behind the gate.
Read