Security researcher chains six minor bugs to achieve pre-authentication remote code execution in LogPoint SIEM/SOAR platform during May 2024 vendor evaluation; exploit leverages exposed routes, hardcoded secrets, leaked credentials, SSRF and eval() sink.

The Story of a Perfect Exploit Chain: Six Bugs That Looked Harmless Until They Became Pre-Auth RCE in a Security Appliance - Mehmet Ince @mdisec

It was May 2024, and our internal security team was evaluating the LogPoint SIEM/SOAR platform to replace our existing platform, potentially. As part of a habit I’ve built over the years —and honestly, part of our 3rd party due diligence— I gave myself 24 hours to do what I always do with any technology we’re about to trust: try to break it. Those 24 hours were enough to uncover three serious vulnerabilities almost immediately. Given their impact, I stopped there and proceeded directly to respon...