https://bokkapig.pages.dev/tags/ssrf/Recent content in SSRF on bokkapigHugoen-gbSat, 01 Aug 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/cohort/Sat, 01 Aug 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/cohort/An internal marimo notebook server — discovered by bypassing an SSRF host blocklist on the Cohort Analytics ‘source validator’ — exposed the unauthenticated /terminal/ws endpoint (CVE-2026-39987), granting a pre-auth PTY as marimo. Privilege escalation abused a deliberately held-back PackageKit (CVE-2026-41651, ‘Pack2TheRoot’): a TOCTOU race in the D-Bus InstallFiles transaction let an unprivileged user install a malicious .deb whose postinst ran as root, dropping a SUID bash.