Research and writing from the people who find the bugs.
Deep-dive vulnerability analyses, weaponized proofs-of-concept, and security research, written by the Starfish founders. Grounded in the public record; sources credited.
- 4
- published write-ups
- 4
- CVEs dissected
- 3
- founding researchers
4 posts
Sitecore CVE-2025-53690: a sample machine key from the docs, turned into unauthenticated RCE
A machine key copied verbatim out of Sitecore's own 2017 deployment guide lets an attacker forge a valid ASP.NET ViewState and reach pre-auth RCE. This is a full walkthrough: from the leaked key, to a ysoserial.net payload that lands, to a fileless in-memory route handler that survives the patch.
- An Ngo5 min
CVE-2024-24842: unauthenticated PHP object injection in a 10,000-install WordPress plugin
A view-counter cookie that nobody thinks about reaches PHP's unserialize() with no authentication. This is how a single unsafe deserialize call in the Knowledge Base plugin becomes a CVSS 9.8 unauthenticated object injection, and the one-line change that fixed it.
CVE-2024-24842 9.8CVE AnalysisDeserializationRead - An Ngo4 min
CVE-2020-7769: command injection in Nodemailer's sendmail transport
When a mail library shells out to /usr/sbin/sendmail, attacker-controlled recipient addresses become sendmail command-line flags. This is how CVE-2020-7769 turns an email field into arbitrary file writes, and how prototype pollution upgrades it to full RCE.
CVE-2020-7769 8.6CVE AnalysisWeb SecurityRead - Dau Hoang Tai8 min
MOVEit Transfer CVE-2023-34362 & CVE-2023-35036: from SQL injection to .NET deserialization RCE
The MOVEit Transfer bug that drove one of 2023's largest breach waves, taken apart end to end: an unauthenticated stacked SQL injection, privilege escalation by inserting an admin, an IP-whitelist bypass, and finally unsafe .NET deserialization for code execution. Plus the second injection, CVE-2023-35036.
CVE-2023-34362 9.8CVE AnalysisWeb SecurityRead