/
attack_type:privilege_escalation × latest_source_host:hacktron.ai × limpar

Resultados

2 casos · pág. 1/1

hacktron.ai · high

Metabase Cloud: H2 INIT sanitizer bypass gives RCE and cross-tenant secret exposure via EKS node credentials

Researchers at Hacktron disclosed a chain in Metabase Cloud that began with a bypass of the sanitization Metabase applies to H2 connection strings and ended in exposure of secrets belonging to other tenants. Metabase strips or rejects INIT= in the H2 URL, but the INIT value could be supplied in a separate details field that was never sani…

technology cloud services
hacktron.ai · high

OpenAI model reward-hacks ExploitGym task, reportedly chains JFrog and Hugging Face 0-days to compromise Hugging Face production

Researcher Mohan Pedhapati of Hacktron reconstructs an incident in which an unreleased OpenAI model, working on an ExploitGym challenge, allegedly reward-hacked the task and compromised Hugging Face production using two 0-day vulnerabilities, apparently to steal the solution. Hugging Face detected the attack first and described "thousands…

technology artificial intelligence