https://m1s0-0.github.io/ Writeups on vulnerability research, exploitation, and smart contract auditing. en M1S0 Fri, 12 Sep 2025 00:00:00 GMT https://m1s0-0.github.io/writeups/posts/langflow-rce-cve-2025-3248.html https://m1s0-0.github.io/writeups/posts/langflow-rce-cve-2025-3248.html An endpoint whose whole job was to check a snippet of Python turned out to run it, with no login required. CVE-2025-3248, found live on an internet-exposed instance, from a validator to a root shell. Fri, 12 Sep 2025 00:00:00 GMT RCE CVE-2025-3248 Langflow Unauthenticated https://m1s0-0.github.io/writeups/posts/coindepo-idor.html https://m1s0-0.github.io/writeups/posts/coindepo-idor.html One profile endpoint decided whose data to return from values in the request, not from who was logged in. Any authenticated user could pull another user's full KYC record. Wed, 10 Sep 2025 00:00:00 GMT IDOR BOLA Broken Access Control API PII https://m1s0-0.github.io/writeups/posts/carthavault-share-manipulation.html https://m1s0-0.github.io/writeups/posts/carthavault-share-manipulation.html The vault priced new shares against a total value that briefly dropped while its assets were in transit to an external pool. Any depositor could exploit that window to mint inflated shares and take value from existing holders. Fri, 05 Sep 2025 00:00:00 GMT Share Price Manipulation DeFi Vault Smart Contract https://m1s0-0.github.io/writeups/posts/dell-dependency-confusion.html https://m1s0-0.github.io/writeups/posts/dell-dependency-confusion.html A package name Dell forgot to claim was all it took. The whole story, in plain English, from the file I found to the bounty that landed. Mon, 01 Sep 2025 00:00:00 GMT Dependency Confusion Supply Chain RCE npm https://m1s0-0.github.io/writeups/posts/openai-discord-csrf-unlink.html https://m1s0-0.github.io/writeups/posts/openai-discord-csrf-unlink.html An unlink action on OpenAI's Discord verification service ran on a plain GET with no anti-CSRF token, so a single crafted link could quietly pull any member out of the OpenAI Discord without their knowledge. Sat, 30 Aug 2025 00:00:00 GMT CSRF OpenAI Discord Authenticated Action https://m1s0-0.github.io/writeups/posts/base-gossip-flood-limiter-bypass.html https://m1s0-0.github.io/writeups/posts/base-gossip-flood-limiter-bypass.html Base's gossip layer caps how many blocks it accepts per height, but it recorded a block only after verifying its signature. Forged-signature blocks were never counted, so the limiter never fired and every one still cost a full ECDSA recovery. Fri, 29 Aug 2025 00:00:00 GMT Denial of Service Consensus Blockchain P2P https://m1s0-0.github.io/writeups/posts/dell-pexip-access-control-bypass.html https://m1s0-0.github.io/writeups/posts/dell-pexip-access-control-bypass.html A Dell video-conferencing app made you pass a join step at one path, then served the same room at a sibling path with no gate at all. Changing a single character in the URL walked straight into the dashboard. Thu, 28 Aug 2025 00:00:00 GMT Broken Access Control Authentication Bypass Web App https://m1s0-0.github.io/writeups/posts/whitemarket-email-bombing.html https://m1s0-0.github.io/writeups/posts/whitemarket-email-bombing.html The resend-verification endpoint was rate limited and even returned 429 under load, but the limit was not atomic. A parallel burst slipped a stack of emails through before the limiter caught up. Wed, 20 Aug 2025 00:00:00 GMT Race Condition Rate Limit Bypass Email Bombing GraphQL https://m1s0-0.github.io/writeups/posts/levex-otp-race-condition.html https://m1s0-0.github.io/writeups/posts/levex-otp-race-condition.html The endpoint that sends a one-time code capped how often you could call it, but not atomically. Firing the same request in parallel slipped a burst past the limit and flooded the mailbox. Fri, 15 Aug 2025 00:00:00 GMT Race Condition Rate Limit Bypass OTP API https://m1s0-0.github.io/writeups/posts/smtp-open-relay-spoofing.html https://m1s0-0.github.io/writeups/posts/smtp-open-relay-spoofing.html A mail server accepted email from anyone, addressed to anyone, claiming to be anyone, with no login. An open relay that turns one forgotten server into a phishing engine. Sun, 10 Aug 2025 00:00:00 GMT SMTP Open Relay Email Spoofing Phishing https://m1s0-0.github.io/writeups/posts/folks-finance-irrevocable-permit.html https://m1s0-0.github.io/writeups/posts/folks-finance-irrevocable-permit.html A role check sat on the wrong side of an approval. Once an admin removed a migrator's role, users could no longer revoke the permit they had given it, leaving a latent authorization over their staked funds that they could not take back. Fri, 08 Aug 2025 00:00:00 GMT Access Control Smart Contract DeFi Griefing https://m1s0-0.github.io/writeups/posts/base-bond-lock-zk-nullification.html https://m1s0-0.github.io/writeups/posts/base-bond-lock-zk-nullification.html A safety timeout was meant to return an honest proposer's bond if a game got stuck, but a ZK verifier nullification stuck it in the one state the timeout was gated against, locking the bond in DelayedWETH with no recovery path. Wed, 06 Aug 2025 00:00:00 GMT Frozen Funds Dispute Game Smart Contract L2