www = web web web · Senior Information Security Engineer @GoogleVRP · Previously @praetorianlabs & @starlabs_sg · Opinions are my own.
Singapore
Joined May 2012
- Tweets115
- Following540
- Followers1.1K
- Likes1.5K
Hi @ttaka_66, thanks for enjoying the talk! The slides/resources are available at gh.io/rubykaigi-2025.
Happy to announce that I'll be speaking alongside @DennisPacewicz at @rubykaigi next week!
We'll be sharing some secret stories on how I gained access to production GitHub credentials using CVE-2024-0200 as well as @GitHubSecurity's remediation efforts.
rubykaigi.org/2025/presentat…
Ngo Wei Lin retweeted
I just published a new blog post sharing an improved Deserialization Gadget Chain for Ruby!
It builds on the work of others, including Leonardo Giovanni, Peter Stöckli @GHSecurityLab and @wcbowling
nastystereo.com/security/rub…
Ngo Wei Lin retweeted
Thrilled to release my latest research on Apache HTTP Server, revealing several architectural issues! blog.orange.tw/2024/08/confu…
Highlights include:
⚡ Escaping from DocumentRoot to System Root
⚡ Bypassing built-in ACL/Auth with just a '?'
⚡ Turning XSS into RCE with legacy code from 1996
Ngo Wei Lin retweeted
🚨 New Blog Alert! 🚨
Can an attacker execute commands by sending JSON? Learn how unsafe deserialization vulnerabilities in Ruby can be exploited and how they can be detected with CodeQL.
🔗 Read the full post: github.blog/2024-06-20-execu…
Stay safe and code responsibly! 🛡️💻
Ngo Wei Lin retweeted
My colleague @hash_kitten and I discovered a full-read SSRF vulnerability in Next.js (CVE-2024-34351). We published our research today on @assetnote's blog: assetnote.io/resources/resea…. Thank you to the Vercel team for a smooth disclosure process.
Ngo Wei Lin retweeted
Here is my deep-dive post on #github Actions cache poisoning. This is a powerful build pipeline lateral movement and privilege escalation technique and I used it to earn several thousand💰in #bugbounty rewards.
adnanthekhan.com/2024/05/06/…
Ngo Wei Lin retweeted
Send()-ing Myself Belated Christmas Gifts - GitHub's Environment Variables & GHES Shell
starlabs.sg/blog/2024/04-sen…
Read about how one of our talented researchers, @Creastery , found it, exploited it and reported it in a fast and professional manner:
Check out my write-up on a seemingly harmless and limited send() in GitHub (CVE-2024-0200) and how it could be used to obtain environment variables from a production container and to achieve remote code execution in GitHub Enterprise Server:
starlabs.sg/blog/2024/04-sen…
Ngo Wei Lin retweeted
Earlier this year I found a pretty cool vuln, an arbitrary file write in GitLab.
Here’s the details gitlab-com.gitlab.io/gl-secu…
Ngo Wei Lin retweeted
Route to Safety: Navigating Router Pitfalls is the swansong from @daniellimws
starlabs.sg/blog/2024/route-…
We hope everyone enjoyed his informative post and wish him all the best in his future endeavours.
Seconded on fixing this insecure default config -- I've already tried pushing for this multiple times but to no avail.
👀
CVE-2024-0200 An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of… cve.org/CVERecord?id=CVE-202…
Hey Joern, the current coordinated disclosure date is set at late April 2024. Hope to share more details and insights then!
This is one of the most insane bugs I've discovered, but it all happened at a really inopportune time. 😥
Shoutout to all the Hubbers who got involved and had been working tirelessly on this since the Christmas/New Year period! 🙏
We received a bug bounty report of a vulnerability which, if exploited, allowed access to credentials within a production container. We have patched GitHub.com and rotated all affected credentials, and patches for GHES are available today. github.blog/2024-01-16-rotat…
There is still one more duplicate entry for "Compromising F5 BIGIP with Request Smuggling", but other than that, I think you got them all.