Intrigus’ Security Lab

What to Do When Creating Your CodeQL Database Fails – and How to Report the Perfect Reproducer Using cvise Recently, a colleague was trying to create a CodeQL database for a specific version of the monad project to perform some security analysis.

RealworldCTF 2024 – Protected-by-Java-SE – Writeup TLDR: Nearly up-to-date (at the time) version of CodeQL and we have to extract the contents of a world-readable /flag file using XXE. 400 points and 8 solves.

Fixing Decompilation of Stack Clash Protected Binaries I was playing DEFCON CTF Quals 2025 with (KITCTF⊂Sauercloud) and I looked into the callmerust challenge.

BraekerCTF 2024 – Injecting Commands – Writeup TLDR: Hidden code in Mach-O load commands and a bit of anti-debugging. 400 points and 2 solves.

Finding Insecure TrustManagers and Disabled Hostname Verification with CodeQL In this post, I want to show how I found five vulnerabilities in usage of the Java TrustManager and HostnameVerifier classes.

Summary ballerina-platform/ballerina-lang used an insecure TrustManager for HTTPS connections making clients vulnerable a to machine-in-the-middle attack (MiTM) and remote code execution (RCE).

Summary openMF/mifos-mobile disabled hostname verification and used an insecure TrustManager for HTTPS connections making clients vulnerable a to machine-in-the-middle attack (MiTM).

Summary opencast/opencast disabled hostname verification and used an insecure TrustManager for HTTPS connections making clients vulnerable a to machine-in-the-middle attack (MiTM).

Summary apache/fineract disabled hostname verification and used an insecure TrustManager for HTTPS connections making clients vulnerable to a machine-in-the-middle attack (MiTM).

Summary The HttpUtils#getURLConnection function of apache/calcite disabled hostname verification and used an insecure TrustManager for HTTPS connections making clients vulnerable to a machine-in-the-middle attack (MiTM).