https://fenrisk.com/research/Recent content in Recherche on FenriskHugofr-FRFri, 02 Oct 2026 01:20:13 +0600https://fenrisk.com/research/open-build-service-2/Fri, 02 Oct 2026 01:20:13 +0600https://fenrisk.com/research/open-build-service-2/In March 2025 we published an analysis of a remote code execution vulnerability in Open Build Service (OBS), tracked as CVE-2024-22033. A little over a year later we went back to the same attack surface and found a second, distinct flaw of the same family. It has now been reported to the openSUSE security team and fixed…https://fenrisk.com/research/hiawatha-http-smuggling/Thu, 23 Jul 2026 01:00:00 +0600https://fenrisk.com/research/hiawatha-http-smuggling/As part of our ongoing research into request smuggling, we identified an HTTP Request Smuggling vulnerability (CWE-444) in Hiawatha ≤ 12.1. Hiawatha is an open-source, security-focused web server for Unix-like systems, used to serve websites and host web applications.https://fenrisk.com/research/mcpwned/Wed, 22 Apr 2026 01:00:00 +0600https://fenrisk.com/research/mcpwned/This blog post quickly outlines the MCP protocol before presenting a Burp Suite extension developed by Fenrisk that enables pentesters to effectively test MCP servers.https://fenrisk.com/research/rce-centos-web-panel-2/Thu, 02 Apr 2026 01:00:00 +0600https://fenrisk.com/research/rce-centos-web-panel-2/As part of our ongoing research into web hosting control panels, we recently published an analysis of Control Web Panel (CWP), a widely used open-source administration panel designed to manage web servers running…https://fenrisk.com/research/atlasscan/Tue, 14 Oct 2025 01:00:00 +0600https://fenrisk.com/research/atlasscan/This blog post presents a tool that identifies the version of the Atlassian Jira or Confluence application and maps the identified version to a local CVE database. The detection is primarily based on the presence of…https://fenrisk.com/research/rce-aapanel/Mon, 08 Sep 2025 01:00:00 +0600https://fenrisk.com/research/rce-aapanel/aaPanel is a free and open-source web hosting control panel designed to simplify server management for Linux-based systems. It provides a graphical interface to manage web servers, websites,…https://fenrisk.com/research/rce-centos-web-panel/Mon, 23 Jun 2025 01:00:00 +0600https://fenrisk.com/research/rce-centos-web-panel/CentOS Web Panel (CWP) is a free web hosting control panel used to manage servers based on CentOS and other RPM-based distributions. CWP was first introduced in 2013 as a free, open-source web hosting control panel…https://fenrisk.com/research/open-build-service/Mon, 10 Mar 2025 01:20:13 +0600https://fenrisk.com/research/open-build-service/Open Build Service (OBS) is an open-source distribution development platform provided by openSUSE. It allows developers to manage the whole packaging process in order to build a package from a simple software source and…https://fenrisk.com/research/pagure-fedora/Mon, 10 Mar 2025 01:19:13 +0600https://fenrisk.com/research/pagure-fedora/As discussed in the meta-article, we picked Pagure from the Fedora Apps Directory and already had a technical approach in mind. A software forge is likely to be a good target for an argument injection: we can expect the…https://fenrisk.com/research/supply-chain-linux/Mon, 10 Mar 2025 01:18:13 +0600https://fenrisk.com/research/supply-chain-linux/Supply chain attacks have been a trendy topic in the past years. Rather than directly attacking their primary target, attackers infiltrate less secure assets, such as software dependencies, firmware, or service…https://fenrisk.com/research/gadget-chains-laravel/Thu, 30 Nov 2023 11:18:13 +0600https://fenrisk.com/research/gadget-chains-laravel/As we have seen in the previous article about wordpress gadgets, very simple gadget chains can be found in major projects. But sometimes finding popchain may be more difficult. This article…https://fenrisk.com/research/gadget-chains-wordpress/Wed, 22 Nov 2023 11:18:13 +0600https://fenrisk.com/research/gadget-chains-wordpress/Exploiting an unserialization vulnerability in WordPress never was a small issue. Unlike other PHP frameworks, and until very recently, WordPress was not known for hosting gadget chains.