Local Privilege Escalation on bokkapig

Reactor

Tue, 04 Aug 2026 14:45:21 +0100

A ReactorWatch monitoring dashboard on port 3000 runs Next.js 15.0.3 with React 19.0.0 — vulnerable to React2Shell (CVE-2025-55182 / CVE-2025-66478), an unauthenticated RCE in the React Server Components Flight deserializer. A POST to / carrying a Next-Action header and a forged circular Flight chunk reaches Function via $1:constructor:constructor, giving code execution as the node service account. The app’s world-readable SQLite database yields engineer’s MD5 password hash, reused verbatim for SSH. Root comes from a root-owned uptime-monitor systemd unit launched with –inspect=127.0.0.1:9229: the Node debug port is an unauthenticated root eval primitive, driven over the Chrome DevTools Protocol.

Cohort

Sat, 01 Aug 2026 00:00:00 +0000

An internal marimo notebook server — discovered by bypassing an SSRF host blocklist on the Cohort Analytics ‘source validator’ — exposed the unauthenticated /terminal/ws endpoint (CVE-2026-39987), granting a pre-auth PTY as marimo. Privilege escalation abused a deliberately held-back PackageKit (CVE-2026-41651, ‘Pack2TheRoot’): a TOCTOU race in the D-Bus InstallFiles transaction let an unprivileged user install a malicious .deb whose postinst ran as root, dropping a SUID bash.

Silentium

Sat, 11 Apr 2026 00:00:00 +0000

A staging Flowise 3.0.5 instance leaks a live password-reset token straight back in the /api/v1/account/forgot-password response (CVE-2025-58434), giving instant takeover of the ben@silentium.htb admin account. Authenticated, the Custom MCP node’s mcpServerConfig (CVE-2025-59528) spawns arbitrary processes, yielding root inside the Flowise container — whose environment block hands over SMTP_PASSWORD, reused verbatim as ben’s system password over SSH. Root comes from a second internal app: Gogs 0.13.3 running as root with open registration, where CVE-2025-8110 lets the contents API write through a committed symlink to overwrite the repository’s pre-receive hook, executed as root on the next push.