Loading story…
Researcher Orange Tsai disclosed an unauthenticated remote-code-execution chain in an Amazon internal collaboration service built on the Nuxeo Java content-management platform. The attack exploited inconsistent handling of URL path parameters between Nuxeo and Tomcat to bypass authentication, then abused legacy JBoss Seam Expression Language functionality and a blacklist bypass to execute arbitrary commands. Amazon isolated and investigated the affected server after receiving the report; Nuxeo released version 8.10 to address the RCE condition.
The finding reflects a broader class of URL-parser inconsistencies that can undermine application security controls. Differences in URL normalization, DNS resolution, and HTTP-client behavior can permit SSRF filter bypasses and protocol smuggling to internal services, including Redis, Memcached, SMTP, Graphite, and Docker. Organizations should upgrade affected Nuxeo deployments, remove or isolate end-of-life JBoss Seam components, avoid reusing attacker-controlled URLs after validation, and enforce network-layer restrictions that prevent application servers from reaching sensitive internal endpoints.
See affected versions and whether adversaries are exploiting it.
8 events from the most recent confirmed update back to the earliest known activity.
Amazon awarded Orange Tsai a bounty for reporting the unauthenticated remote-code-execution chain affecting its internal collaboration service.
Nuxeo released version 8.10, which patched the RCE condition used in the Amazon collaboration-service exploit chain. The mitigation overrode Seam's vulnerable callAction behavior.
Orange Tsai reported an unauthenticated remote-code-execution chain affecting Amazon's internal collaboration service at collaborate-corp.amazon.com. Amazon acknowledged the report within about 25 minutes, investigated the issue, isolated the affected server, and coordinated with the researcher.
Orange Tsai presented research showing that inconsistent path normalization among web frameworks, reverse proxies, and backend containers can enable directory traversal, ACL bypass, and potential RCE. The research examined vulnerabilities including Spring CVE-2018-1271 and Rails/Sprockets CVE-2018-3760, and demonstrated semicolon path-parameter discrepancies such as `..;` that can bypass proxy routing and access controls.
Researchers described an exploit chain combining a webhook SSRF bypass, SSRF in internal Graphite, Python httplib CR-LF injection, and unsafe Ruby Marshal handling in Memcached. The chain enabled remote code execution on GitHub Enterprise versions earlier than 2.8.7.
cURL 7.54 fixed a parser/requester inconsistency involving malformed userinfo and port syntax, including URLs resembling "http://foo@127.0.0.1:11211@google.com:80/".
PHP 7.0.13 fixed a discrepancy in which validation and request handling could interpret URLs such as "http://127.0.0.1:11211#@google.com:80/" differently, enabling SSRF bypasses.
Orange Tsai presented research showing that inconsistent URL parsers, DNS resolvers, and HTTP client libraries can bypass SSRF defenses and enable access to internal services. The presentation demonstrated techniques including host and port confusion, CR-LF injection, double decoding, IDNA mismatches, and TLS SNI injection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers from Novee disclosed 12 vulnerabilities across four enterprise Java platforms, highlighting two pre-authentication remote code execution chains that affected **Bonita BPM 10.4.3** and **Apache OFBiz 24.09.05**. The findings were presented at Black Hat USA 2026, with Bonita’s chain showing that a single unauthenticated `POST` request could bypass routing, authentication, and CSRF protections to reach an internal API that deserialized attacker-controlled XML through **XStream**, resulting in code execution. Novee said the broader audit also uncovered four pre-login flaws and a sandbox escape, but identified Bonita and OFBiz as the most severe cases. In Apache OFBiz, researchers found that a default signing key exposed in the public source repository allowed attackers to forge JWT-based SSO tokens, impersonate an administrator, and then abuse callback token handling plus Groovy expression evaluation in the widget engine to achieve unauthenticated RCE. The issue, tracked as **`CVE-2026-31986`** and rated **Critical**, reportedly required SSO to be enabled and could be triggered with only two `GET` requests. Both vendors released fixes within a standard 90-day disclosure window, while researchers urged organizations to apply updates, replace shared signing keys, normalize paths in authentication and CSRF filters, protect all dispatcher paths, and restrict deserialization and template evaluation features.
Aug 7, 2026
dCERT issued advisories for two vulnerabilities affecting **Sonatype Nexus Repository Manager**, warning that one flaw allows **cross-site scripting (XSS)** and another can **bypass security measures** and may lead to **potential code execution**. The issues affect a widely used artifact repository platform that often sits in software build and package distribution workflows. The paired advisories indicate risk ranging from browser-based compromise through XSS to more serious server-side impact if security controls can be circumvented. Organizations using Sonatype Nexus Repository Manager should review the relevant dCERT advisories, identify affected deployments, and prioritize vendor guidance and remediation to reduce exposure in development and supply-chain infrastructure.
Jun 29, 2026
Red Hat disclosed **CVE-2014-0248**, an important-severity code-injection flaw in JBoss Seam's `org.jboss.seam.web.AuthenticationFilter`. Improper use of Seam logging allows an unauthenticated remote attacker to submit specially crafted authentication headers and execute arbitrary code with the privileges of the affected application process. Red Hat classified the vulnerability as CWE-94 and assigned it a CVSS v2 base score of 6.8; Marek Schmidt of Red Hat discovered the issue. Affected products included JBoss Enterprise Application Platform 5.2.0, JBoss Enterprise Web Platform 5.2.0, JBoss Web Framework Kit, JBoss Web Platform, and JBoss SOA Platform 5.3. Red Hat released updates through advisories including RHSA-2014:0792, RHSA-2014:0793, RHSA-2014:0794, and RHSA-2015:1888; administrators should install the applicable updated `jboss-seam2` packages or platform updates and restart JBoss server processes. Red Hat BPM Suite 6 was not affected.
Aug 29, 2026