https://0s1mt.github.io/Security research, source code analysis, and vulnerability write-ups by Abdulsamet Sunar. 2026-03-24T00:22:41+03:00 Abdulsamet Sunar https://0s1mt.github.io/ Jekyll © 2026 Abdulsamet Sunar /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-03-23T01:00:00+03:00 2026-03-23T01:00:00+03:00 https://0s1mt.github.io/posts/rce-via-exec-in-config-loader-tr/ Abdulsamet Sunar

CI/CD pipeline’larda kullanılan bir Python build/otomasyon aracını inceliyordum. Diğer sekmelerimi kapatıp dikkatimi toplamama neden olan bir şey buldum. Aracın bir config yükleme fonksiyonu vardı. Basit konsept: bir Python config dosyasını oku, ayarları çıkar, dict olarak döndür. Binlerce projede bulunan türden bir utility fonksiyon. Tek farkla — bu exec() kullanıyordu. Ve dosya yolu kullanıc...

2026-03-23T00:00:00+03:00 2026-03-23T00:00:00+03:00 https://0s1mt.github.io/posts/rce-via-exec-in-config-loader/ Abdulsamet Sunar

I was auditing a Python project — a build/automation tool used in CI/CD pipelines — when I found something that made me close my other tabs and sit up straight. The tool had a config loading function. Simple concept: read a Python config file, extract the settings, return them as a dict. The kind of utility function that exists in thousands of projects. Except this one used exec() to do it. An...

2026-03-12T00:00:00+03:00 2026-03-15T23:37:06+03:00 https://0s1mt.github.io/posts/source-code-analysis-example/ Abdulsamet Sunar

Reading source code often goes like this: you’re browsing through a library, everything looks fine, you’re about to close the tab — then one line catches your eye. “Why isn’t that header in this list?” And that question is where this write-up starts. Starting Point: A Frozenset in retry.py While reading retry.py, lines 197–199 caught my attention: #: Default headers to be used for ``remove...