Web-Exploitation - CraftedSignal Threat Feed

9routers Database Exposure and Takeover via Insecure API

hello@craftedsignal.io — Mon, 06 Jul 2026 21:43:46 +0000

A critical vulnerability, tracked as CVE-2026-55500, has been identified in 9routers versions 0.4.71 and earlier. This flaw resides in the /api/settings/database API endpoint, which is intended for database export and import functionalities. Despite being protected by an ALWAYS_PROTECTED middleware requiring a valid JWT or CLI token, this protection is deemed insufficient. An attacker, having obtained a valid token (potentially through default credentials like "123456" or other means), can exploit this endpoint to perform a full export of the application's database. This export includes highly sensitive information such as plaintext API keys, OAuth tokens, OIDC client secrets, and hashed user credentials. Furthermore, the attacker can import a modified database, enabling a complete wipe and overwrite of the existing database, which can be leveraged to replace administrator password hashes, gain persistent access, and achieve full system takeover. This vulnerability poses a severe risk to the confidentiality, integrity, and availability of affected 9router instances.

Attack Chain

Initial Access / Credential Acquisition: An attacker identifies an accessible 9router instance and obtains an initial valid JWT or CLI token, potentially leveraging default credentials (e.g., '123456') or other initial access methods.
Reconnaissance / Sensitive Endpoint Access: Using the acquired token, the attacker sends an HTTP GET request to the /api/settings/database endpoint to understand its functionality and extract current configuration.
Data Exfiltration / Credential Dumping: The vulnerable endpoint responds with a full database export, providing the attacker with highly sensitive information, including plaintext API keys, OAuth tokens, OIDC client secrets, and hashed user credentials.
Data Manipulation: The attacker analyzes the exfiltrated database content, identifies critical entries (such as administrator password hashes), and modifies them to establish their own privileged access.
Privilege Escalation / Persistence (Database Import): The attacker crafts an HTTP POST request containing the manipulated database payload and sends it to the /api/settings/database endpoint, authenticating with their valid token.
System Control / Database Overwrite: The 9router application processes this malicious import request, completely overwriting its operational database with the attacker's controlled data, including new administrator credentials.
Impact / Full Takeover: The attacker can now log in to the 9router instance using their newly set credentials, gaining full administrative control and potentially leveraging the previously stolen API keys for further malicious activities.

Impact

The successful exploitation of CVE-2026-55500 leads to severe consequences across multiple domains. Confidentiality is completely breached through the exposure of all stored secrets, including plaintext API keys, OAuth tokens, and OIDC client secrets, which could facilitate lateral movement or access to connected services. Integrity is compromised as attackers can perform a full database replacement with their own controlled data, effectively rewriting all application settings and user credentials. This allows for persistent control and unauthorized modifications. Furthermore, availability can be impacted if an attacker chooses to import an empty or malformed database, leading to a denial of service for the 9router application. This vulnerability enables a complete system takeover.

Recommendation

Patch Immediately: Upgrade 9router to a version greater than 0.4.71 to address CVE-2026-55500.
Implement Strong Authentication: Ensure that highly sensitive endpoints like /api/settings/database require multi-factor authentication or re-authentication with current credentials, not just an existing session.
Deploy Sigma Rules: Deploy the provided Sigma rule to your SIEM to detect attempts to access the /api/settings/database endpoint and investigate any alerts.
Review Logs: Audit webserver access logs for http://localhost:20128/api/settings/database (or your production URL) for any suspicious GET or POST requests.
Rotate Credentials: Immediately rotate all API keys, OAuth tokens, and other secrets if an instance of 9router was running a vulnerable version.

Gitea: Multiple Vulnerabilities Leading to XSS, Info Disclosure, and File Manipulation

hello@craftedsignal.io — Mon, 06 Jul 2026 08:29:46 +0000

The German Federal Office for Information Security (BSI) has issued a high-severity alert regarding multiple unpatched vulnerabilities in Gitea, a popular self-hosted Git service. These vulnerabilities allow an attacker to bypass security measures, disclose sensitive information, execute Cross-Site Scripting (XSS) attacks, and manipulate files. While specific Common Vulnerabilities and Exposures (CVE) identifiers have not been released, the broad range of potential impacts indicates significant risk to Gitea instances if exploited. Organizations using Gitea versions without the latest security fixes are advised to prioritize updates. The advisory, published on 2026-07-06, highlights the importance of timely patching to prevent unauthorized access and data compromise, emphasizing that the absence of detailed CVEs does not diminish the severity of the threat.

Attack Chain

Initial Access: An attacker identifies a vulnerable Gitea instance and sends specially crafted HTTP requests to the application.
Vulnerability Exploitation: Gitea processes the malicious input, leading to the exploitation of one or more undisclosed vulnerabilities, such as input validation flaws or authorization bypasses.
XSS Execution: If Cross-Site Scripting (XSS) vulnerabilities are triggered, malicious client-side scripts are injected and executed within a victim's browser session when they interact with the compromised Gitea application.
Security Bypass / Information Disclosure: Successful exploitation may bypass authentication or authorization mechanisms, granting unauthorized access, or lead to the exposure of sensitive data from the Gitea application or its underlying system.
File Manipulation: Attackers leverage vulnerabilities to manipulate arbitrary files on the server hosting Gitea, potentially altering configurations, modifying web content, or placing malicious files like web shells.
Achieved Impact: The attacker achieves objectives such as data exfiltration, establishing persistent access through manipulated files, or causing denial of service by corrupting critical system components or databases.

Impact

Successful exploitation of these Gitea vulnerabilities could lead to significant consequences for affected organizations. Attackers could gain unauthorized access to sensitive code repositories, intellectual property, or user credentials through information disclosure and security bypass flaws. Cross-Site Scripting attacks might enable session hijacking, credential theft, or further client-side exploitation against legitimate users. Furthermore, file manipulation capabilities could allow attackers to establish persistence by planting web shells, altering configurations, or deploying malicious payloads, potentially leading to full system compromise or supply chain attacks if malicious code is injected into software projects.

Recommendation

Update Gitea to the latest stable version to address the multiple vulnerabilities identified, including those leading to security bypass, information disclosure, XSS, and file manipulation.
Monitor web server logs (e.g., webserver category) for Gitea for unusual HTTP requests, particularly those exhibiting characteristics of attempted exploitation for information disclosure or file manipulation.
Enforce robust Content Security Policies (CSPs) within Gitea deployments to mitigate the execution of malicious client-side scripts, a common outcome of Cross-Site Scripting (XSS) vulnerabilities.

CVE-2026-14747: SQL Injection in code-projects Real State Services 1.0

hello@craftedsignal.io — Sun, 05 Jul 2026 13:21:42 +0000

A critical SQL Injection vulnerability, tracked as CVE-2026-14747, has been identified in version 1.0 of the code-projects Real State Services application. This flaw resides within an unspecified function of the /addprojectsale.php file, where improper handling of user-supplied input to the amen argument allows for remote, unauthenticated attackers to inject and execute arbitrary SQL commands. This enables attackers to bypass security measures, extract sensitive information from the underlying database, or potentially achieve further system compromise depending on the database's privileges. The vulnerability was publicly disclosed on July 5, 2026, by VulDB and is a significant concern for organizations using this specific version of the Real State Services application, as exploitation can lead to severe data breaches.

Attack Chain

An unauthenticated attacker identifies a web-facing instance of code-projects Real State Services 1.0.
The attacker crafts a specially designed HTTP POST request targeting the /addprojectsale.php endpoint.
This request includes a malicious SQL injection payload within the amen parameter, bypassing input validation.
The vulnerable application processes the request, incorporating the unsanitized amen parameter value directly into a database query.
The backend SQL database executes the attacker-supplied malicious SQL commands, leading to unauthorized access.
Successful exploitation allows the attacker to read, modify, or delete database contents, extract sensitive data, or potentially establish persistence (e.g., by writing a web shell if sufficient database privileges exist).
The attacker then proceeds with data exfiltration or further compromise of the affected web server.

Impact

Successful exploitation of CVE-2026-14747 can lead to severe consequences for organizations utilizing code-projects Real State Services 1.0. Attackers can gain complete control over the application's database, leading to unauthorized disclosure of sensitive customer data, property listings, or internal operational information. This can result in significant financial losses, reputational damage, regulatory penalties, and potential service disruption. The remote and unauthenticated nature of the vulnerability means that any internet-exposed instance of the application is at risk, potentially affecting numerous small to medium-sized businesses in the real estate sector.

Recommendation

Immediately update code-projects Real State Services to a patched version once available to remediate CVE-2026-14747.
Deploy the provided Sigma rule to your SIEM solution to detect exploitation attempts against CVE-2026-14747.
Review web server logs for suspicious activity targeting /addprojectsale.php with SQL injection patterns.
Implement a Web Application Firewall (WAF) in front of the application to filter and block malicious SQL injection payloads.

CVE-2026-14744: Remote SQL Injection in code-projects Real State Services 1.0

hello@craftedsignal.io — Sun, 05 Jul 2026 12:19:55 +0000

A critical SQL injection vulnerability, identified as CVE-2026-14744, has been discovered in code-projects Real State Services version 1.0. This flaw, published on July 5, 2026, resides within an unspecified function of the /normalHomeRent.php file. An unauthenticated, remote attacker can exploit this vulnerability by manipulating the loc argument in an HTTP GET request, bypassing security controls and enabling direct interaction with the backend database. The public release of an exploit significantly escalates the risk, making this an immediate and high-priority concern for organizations utilizing this software. Successful exploitation can lead to unauthorized access to sensitive data, data manipulation, or, in severe cases, remote code execution on the underlying server, severely impacting data confidentiality, integrity, and system availability.

Attack Chain

An unauthenticated attacker identifies an internet-facing instance of code-projects Real State Services 1.0.
The attacker crafts a malicious HTTP GET request targeting the vulnerable /normalHomeRent.php endpoint.
The request includes a specifically engineered SQL injection payload embedded within the loc URL parameter (e.g., loc=' UNION SELECT NULL,version(),NULL,NULL-- -).
The vulnerable Real State Services application processes this request without adequate input sanitization or validation for the loc parameter.
The web application's backend code embeds the malicious payload directly into an SQL query that is sent to the database.
The backend database executes the manipulated SQL query, which may result in sensitive data being returned in the HTTP response, or the execution of arbitrary database commands.
The attacker retrieves the database's response, potentially gaining access to confidential information, modifying database records, or facilitating further system compromise.

Impact

Successful exploitation of CVE-2026-14744 grants remote, unauthenticated attackers the ability to perform SQL injection, leading to significant compromises. The primary impact includes unauthorized access to sensitive database information, such as user credentials, personal data, or proprietary business information. Attackers could also manipulate or delete data, severely affecting data integrity. In some scenarios, depending on the database configuration and type of SQL injection, remote code execution might be achievable on the server hosting the application, leading to full system compromise. With a public exploit available, the number of potential victims is high, spanning any organization or individual using the affected code-projects Real State Services 1.0 software.

Recommendation

Immediately apply patches or security updates for code-projects Real State Services 1.0 as they become available from the vendor, code-projects.
Deploy the Sigma rule provided in this brief to your SIEM/detection platform to identify attempts to exploit CVE-2026-14744.
Ensure web application firewalls (WAFs) are configured to detect and block common SQL injection patterns, specifically targeting the loc parameter in /normalHomeRent.php.
Implement strong input validation and parameterized queries in any custom web applications to prevent similar SQL injection vulnerabilities.
Review web server access logs for any suspicious requests targeting /normalHomeRent.php with unusual loc parameter values, especially those matching the IOCs or patterns in the Sigma rule.

CVE-2026-14737: Hanwang e-Face General Management Platform SQL Injection

hello@craftedsignal.io — Sun, 05 Jul 2026 11:21:39 +0000

A critical SQL injection vulnerability, tracked as CVE-2026-14737, has been identified in Hanwang e-Face General Management Platform version 6.3.5.4. This flaw resides in an unknown function within the /sysAuthStr/querySysAuthStr.do file, where improper handling of argument order allows for remote SQL injection. The vulnerability enables unauthenticated attackers to execute arbitrary SQL queries against the underlying database, potentially leading to information disclosure, data manipulation, or denial of service. The CVSS v3.1 base score is 7.3 (High). Crucially, an exploit for this vulnerability is publicly available, significantly increasing the risk of widespread exploitation by malicious actors. Organizations utilizing the affected Hanwang e-Face General Management Platform are urged to address this vulnerability immediately to prevent compromise.

Attack Chain

An unauthenticated attacker crafts a malicious HTTP request targeting the vulnerable /sysAuthStr/querySysAuthStr.do endpoint on a Hanwang e-Face General Management Platform 6.3.5.4 instance.
The attacker manipulates the order of arguments or introduces specific SQL metacharacters within the HTTP request parameters, leveraging the flaw in the application's input validation logic.
The application processes the malformed request, mistakenly interpreting the attacker-controlled input as legitimate SQL commands.
The embedded SQL injection payload executes within the application's database context, bypassing intended security controls.
Depending on the attacker's objective and database permissions, this can lead to unauthorized data exfiltration (e.g., user credentials, sensitive business data) or manipulation (e.g., altering records, creating new administrative accounts).
The attacker leverages the retrieved or modified data for further compromise, such as gaining higher privileges within the application or pivoting to other systems within the network.

Impact

Successful exploitation of CVE-2026-14737 could lead to severe consequences for affected organizations. Attackers could gain unauthorized access to sensitive data stored in the Hanwang e-Face General Management Platform's database, including personal information, access credentials, or operational data. This data could be exfiltrated, modified, or deleted, leading to data breaches, reputational damage, regulatory fines, and operational disruption. The public availability of an exploit significantly increases the likelihood of opportunistic attacks, potentially affecting any organization using the vulnerable version of the platform.

Recommendation

Immediately patch Hanwang e-Face General Management Platform to a version that remediates CVE-2026-14737 as soon as one becomes available.
Deploy the Sigma rule "Detect CVE-2026-14737 Exploitation - Hanwang e-Face SQL Injection" to your SIEM to identify attempts to exploit /sysAuthStr/querySysAuthStr.do.
Implement Web Application Firewall (WAF) rules to detect and block common SQL injection patterns and suspicious requests targeting the /sysAuthStr/querySysAuthStr.do path.
Enable comprehensive webserver access logging to capture full HTTP request details (headers, methods, URIs, query strings, body) for forensics and analysis.

Web Server Cloud Metadata SSRF Exploitation

hello@craftedsignal.io — Fri, 03 Jul 2026 15:30:46 +0000

This threat involves the exploitation of Server-Side Request Forgery (SSRF) vulnerabilities found in web applications hosted on various platforms, including Nginx, Apache, IIS, and Traefik. Attackers leverage these vulnerabilities to manipulate web servers into making outbound requests to internal cloud instance metadata service (IMDS) endpoints. Such endpoints are typically associated with cloud providers like Amazon Web Services (AWS), Google Cloud Platform (GCP), and Microsoft Azure, and are used to provision temporary credentials, tokens, and instance-specific information. The objective is to steal these credentials, enabling unauthorized access and control over cloud resources, which can lead to data exfiltration, resource manipulation, or further lateral movement within the cloud environment. This technique is a well-known method for escalating privileges in compromised cloud workloads.

Attack Chain

Initial Access via SSRF Vulnerability: An attacker identifies and exploits a Server-Side Request Forgery (SSRF) vulnerability within a public-facing web application, which could be running on Nginx, Apache, IIS, or Traefik.
Internal Request Injection: The attacker crafts a malicious HTTP request, embedding an internal cloud instance metadata service (IMDS) endpoint (e.g., http://169.254.169.254/latest/meta-data/) within a user-controlled URL or query parameter.
Web Server Initiates Internal Connection: The vulnerable web application processes the malicious request and, due to the SSRF flaw, makes an outbound HTTP connection to the specified internal IMDS endpoint as if it were a legitimate internal service request.
Metadata Service Response: The cloud instance metadata service responds to the web server's request, providing sensitive information such as temporary IAM role credentials (e.g., meta-data/iam/security-credentials), API tokens (e.g., latest/api/token), or instance configuration details.
Credential Exfiltration: The web application receives the sensitive metadata or credentials and, depending on the SSRF exploit, leaks this information back to the attacker as part of the HTTP response or through other channels.
Cloud Resource Compromise: The attacker uses the stolen temporary credentials to authenticate to the cloud provider's APIs (e.g., AWS CLI, GCP SDK), gaining unauthorized access to cloud resources, potentially leading to data exfiltration, privilege escalation, or further attacks.

Impact

A successful SSRF attack against cloud instance metadata services can lead to significant compromise of cloud environments. Attackers can steal temporary credentials associated with the compromised workload, gaining unauthorized access to critical cloud resources, sensitive data, and the ability to manipulate cloud configurations. This can result in data breaches, resource hijacking, disruption of services, and the establishment of persistent access within the victim's cloud infrastructure. The breadth of potential impact depends on the permissions granted to the compromised instance's role or service account, which often include access to databases, object storage, and other core services.

Recommendation

Deploy the Sigma rule "Web Server Cloud Metadata SSRF Request" to your SIEM to detect inbound HTTP requests containing cloud metadata endpoints.
Block the C2 domains and IP addresses listed in the IOC table at the network perimeter (firewall/WAF) to prevent outbound connections to known metadata services from unauthorized sources.
Implement strict outbound access controls and allowlisting at the network and application layer to restrict web applications from initiating connections to link-local addresses (e.g., 169.254.169.254) and other internal network ranges.
Enforce the use of IMDSv2 (Instance Metadata Service Version 2) on AWS EC2 instances, and similar authenticated access mechanisms for other cloud providers, to require session tokens for metadata access.
Regularly review and audit the permissions of cloud instance roles and managed identities, adhering to the principle of least privilege to minimize the impact of credential compromise.

Steeltoe Host Header Bypass Vulnerability (CVE-2026-50194)

hello@craftedsignal.io — Fri, 03 Jul 2026 11:24:19 +0000

A critical vulnerability (CVE-2026-50194) in Steeltoe applications allows unauthenticated remote attackers to bypass port isolation for management endpoints. This flaw affects configurations where Management:Endpoints:Port is explicitly set to a port different from the application's primary listener. The middleware, intended to restrict access, incorrectly relies on the Host HTTP header rather than the actual network socket port. By crafting a request with a spoofed Host header specifying the management port, attackers can trick the application into granting access to all actuator endpoints. This enables unauthorized control, information disclosure, and potential configuration manipulation, making it a high-severity concern for organizations using vulnerable Steeltoe versions, specifically Steeltoe.Management.Endpoint up to 4.1.0 and Steeltoe.Management.EndpointCore versions between 3.2.2 and 3.3.0.

Attack Chain

Attacker identifies a publicly accessible Steeltoe application that is likely using management endpoints.
The target Steeltoe application is configured with Management:Endpoints:Port set to a port different from its main listener (e.g., application on 80/443, management on 8080).
Attacker crafts an HTTP request targeting the application's main listener port, typically 80 or 443.
The crafted request includes a spoofed Host HTTP header, setting its value to the application's domain combined with the configured Management:Endpoints:Port (e.g., Host: example.com:8080).
The request scheme (HTTP/HTTPS) matches the Management:Endpoints:SslEnabled setting of the application.
The Steeltoe middleware, upon receiving the request, evaluates the Host header for port isolation rather than the actual socket port the request arrived on.
The spoofed Host header causes the middleware to erroneously permit access as if the request originated on the designated management port.
Attacker gains unauthenticated access to all management actuator endpoints (e.g., /actuator/health, /actuator/env), enabling information disclosure or potential configuration changes.

Impact

The successful exploitation of CVE-2026-50194 grants unauthenticated remote attackers full access to Steeltoe's management actuator endpoints. This can lead to severe consequences, including sensitive information disclosure (e.g., environment variables, application configuration), arbitrary configuration modifications, and potentially remote code execution if certain actuators are exposed and misconfigured. While no specific victim count has been reported, any organization deploying Steeltoe applications with the described vulnerable configuration is at risk. The ease of exploitation via a simple HTTP header manipulation makes this a high-risk vulnerability for data exposure and unauthorized system control.

Recommendation

Immediately upgrade Steeltoe.Management.Endpoint to version 4.1.1 or higher, and Steeltoe.Management.EndpointCore to version 3.3.1 or higher, to address CVE-2026-50194.
Deploy the provided Sigma rule to your SIEM, tuning cs-host to match your expected application domain and monitoring for cs-uri-stem containing /actuator/ with unexpected port values in the Host header.
Implement explicit ASP.NET Core authorization (RequireAuthorization) on all sensitive actuator endpoints as a defense-in-depth measure, as recommended by the Steeltoe advisory.
Configure reverse proxies or load balancers in front of Steeltoe applications to strictly enforce expected Host header values, preventing clients from specifying arbitrary ports.