Eval-Injection on Łukasz Pastuszak - security noteshttps://lukaszpastuszak.dev/tags/eval-injection/Recent content in Eval-Injection on Łukasz Pastuszak - security notesHugoen-usSat, 13 Jul 2019 00:00:00 +0000Crafthttps://lukaszpastuszak.dev/writeups/craft/Sat, 13 Jul 2019 00:00:00 +0000https://lukaszpastuszak.dev/writeups/craft/A Gogs-leaked Python eval() injection in a beer-catalog API drops root inside a container; database credential reuse unlocks a private repo and an SSH key, and a leftover root-policy Vault token mints a one-time SSH password for root.