Comment by himata4113
4 days ago
As wild as this sounds, redis should not exposed to the internet and this appears to be an authenticated RCE. This is similar to claiming that a PSQL query grants code execution when its actually a feature.
These systems are typically not tested as aggressively against vulnerabilities of that nature since 10 times out of 10 you have to have access to these systems already.
Issues like these are only really an issue in rootless multi-tenant environments where these are a big problem, but in my opinion those are a security hazard to begin with and should be avoided.
There is a way more interesting telegram RCE that kimi k3 allegedly discovered.
>There is a way more interesting telegram RCE that kimi k3 allegedly discovered.
Telegram server or client? The client is open source, so I expect any reasonably capable model to find things there sooner or later. But the sever is closed source. Finding an RCE there would be wild for such a model, since it would have to solve a whole bunch of adjacent problems instead of just digesting tons of code.
I mean having the client source code can show you a vast number of the API's and their fields which allows you to fuzz the server quite a bit more easily.
Maybe. The RCE was on the Telegram Desktop client though.
Yep. For managed postgres our threat model is to assume vm is compromised. It's paid off, just earlier this year there was RCE fix in PG 18.4