# Pre-auth input to dangerous sink

Unauthenticated routes reaching SQL, command, or object sinks, or leaking secrets that gate them

_Area: Web injection and code execution. Seen in 2 disclosed reports; one confirmed bounty: $20,000; latest 2022-08-06. Updated 2026-10-25._

## How it works
A request that needs no login reaches a sink that assumes the caller is trusted. Either an attacker-controlled parameter flows unsanitized into a dangerous operation (SQL, OS command, object instantiation), or the endpoint leaks a secret (password hash, MAC) that lets an attacker forge the signature guarding that sink. The broken assumption is that "unauthenticated means harmless" or "the signature proves the caller."

## Where it shows up
- Router whitelists: methods listed in every bypass array (no-login, no-check, no-header) are the unauthenticated entry points [E2](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation.md)
- Request params passed to `popen`/`exec` or object instantiation [E2](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation.md); params concatenated into SQL [E3](https://bugbountylibrary.com/r/h1%3A135288.md)
- Endpoints returning hashes, MACs, or tokens used to sign later requests [E2](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation.md)
- WAF and backend disagreeing on URL decoding, letting encoded traversal reach a hidden route [E1](https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md)
- Load-balancer wildcard rules routing a benign-looking prefix to a sensitive app [E1](https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md)
- Abandoned plugins still installed, source pullable from SVN [E3](https://bugbountylibrary.com/r/h1%3A135288.md)

## How to review
Trace each unauthenticated route to its sink and confirm the invariant: no attacker-controlled value reaches a dangerous operation without validation, and no secret that gates a sink is exposed pre-auth. For routers, intersect all bypass lists to find methods passing every check [E2](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation.md). For WAF-fronted apps, verify the WAF and backend decode URLs identically and that wildcard routes don't expose internal paths [E1](https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md). For plugins, check whether removed plugins remain active and grep for direct `$_POST` concatenation [E3](https://bugbountylibrary.com/r/h1%3A135288.md).

## Variants seen
- Encoding mismatch: `%2e%2e%3b` passes the WAF, backend normalizes to traversal, reaching JSON Web Service typed-parameter instantiation for pre-auth RCE [E1](https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md)
- Secret leak enabling forged signatures, then unsanitized `raidtype` into `popen` for root RCE [E2](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation.md)
- Adjacent, not core: unescaped POST params into SQL in an abandoned plugin, reachable only via CSRF against a logged-in admin [E3](https://bugbountylibrary.com/r/h1%3A135288.md)

## Impact and severity
E1 and E2 reached code execution with no credentials; E3 yielded DB extraction but required an admin session. Severity is high because no login is needed; it worsens when the sink runs as root [E2](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation.md), when a WAF gives false confidence [E1](https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md), and when abandoned code is left installed [E3](https://bugbountylibrary.com/r/h1%3A135288.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md
- E2: https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation.md
- E3: https://bugbountylibrary.com/r/h1%3A135288.md