internet-facing-service-vulnerabilityproof-of-concept-releaseinitial-access-method

Web Application Vulnerabilities: CSRF via GraphQL, XSS, XXE, and SSRF/LFI Exploits

Vulnerability Disclosure · 4 sources · Updated 4mo ago · First seen Dec 28, 2025

Multiple web application vulnerabilities have been disclosed, highlighting the risks associated with misconfigured APIs and file upload functionalities. One report demonstrates how a misconfigured GraphQL endpoint, which accepts application/x-www-form-urlencoded content types, can be exploited for Cross-Site Request Forgery (CSRF) attacks. Attackers can craft malicious HTML forms to submit GraphQL mutations, such as changing user email addresses, without proper user consent. Another case details a $100 bug bounty awarded for discovering XSS via malicious PDF uploads and input validation bypasses that led to denial-of-service conditions on a coding platform.

Further research describes a blind XML External Entity (XXE) vulnerability in a "Check stock" feature, where attackers can trigger out-of-band DNS and HTTP requests using Burp Collaborator, confirming the presence of XXE. Additionally, a $1,500 bounty was awarded for exploiting an image upload feature at Rockstar Games, where a vulnerable ImageMagick instance enabled a chain of attacks including Local File Inclusion (LFI), Server-Side Request Forgery (SSRF), and remote file access via SMB paths. These incidents underscore the importance of strict input validation, secure API configurations, and careful handling of file uploads in web applications.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Dec 27, 2025 – Dec 28, 2025

Dec 28, 202510mo ago
GraphQL endpoint accepted form-encoded requests, enabling CSRF
A web application was found to accept GraphQL requests with application/x-www-form-urlencoded instead of only application/json, allowing attackers to embed GraphQL mutations in auto-submitting HTML forms. This made it possible to trigger authenticated actions such as changing a user's email address through cross-site request forgery.
Dec 27, 202510mo ago
Private coding platform vulnerabilities reported and rewarded
A security researcher found multiple flaws in a private coding platform, including a remote code execution issue, an XSS vector via malicious PDF upload, and an input-validation bypass in a team name field that caused a denial-of-service condition. The issues were responsibly disclosed and acknowledged by the platform, with bounties awarded to the researcher.
Dec 27, 202510mo ago
Rockstar Games image upload flaw enabled SSRF and LFI
Security researcher alexbirsan discovered a critical vulnerability in Rockstar Games' emblem editor in which SVG-to-PNG conversion via a vulnerable ImageMagick version could be chained into local file inclusion, server-side request forgery, internal HTTP response disclosure, and remote file access over SMB. The finding was documented as report #347139.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Organizations

1 linked

Rockstar Games

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

4 references tracked. Mallory keeps watching after this page renders.

Osint Team BlogNews · Dec 28, 2025

Performing CSRF Exploits over GraphQL APIsOpen source ↗

Infosec WriteupsNews · Dec 27, 2025

$100 bounty — XSS & Input ValidationOpen source ↗

Osint Team BlogNews · Dec 27, 2025

Lab: Blind XXE with out-of-band interactionOpen source ↗

Osint Team BlogNews · Dec 27, 2025

$1,500 Bounty: Image Upload Led to Full SSRF & LFI at Rockstar GamesOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Web Application Vulnerabilities: CSRF via GraphQL, XSS, XXE, and SSRF/LFI Exploits

How this story unfolded

GraphQL endpoint accepted form-encoded requests, enabling CSRF

Private coding platform vulnerabilities reported and rewarded

Rockstar Games image upload flaw enabled SSRF and LFI

Related entities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Web Application Security Vulnerabilities and Exploitation Techniques

Real-World Web Application Vulnerabilities Leading to Account Takeover and Data Exposure

Bug Bounty Discoveries: Critical Vulnerabilities in Web Applications

Web Application Vulnerabilities: CSRF via GraphQL, XSS, XXE, and SSRF/LFI Exploits

How this story unfolded

GraphQL endpoint accepted form-encoded requests, enabling CSRF

Private coding platform vulnerabilities reported and rewarded

Rockstar Games image upload flaw enabled SSRF and LFI

Related entities

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Web Application Security Vulnerabilities and Exploitation Techniques

Real-World Web Application Vulnerabilities Leading to Account Takeover and Data Exposure

Bug Bounty Discoveries: Critical Vulnerabilities in Web Applications