# Pre-auth endpoint to dangerous sink

Unauthenticated handler passing request data into deserializer, JDBC URI, or command without allowlist

_Area: Web injection and code execution. Seen in 4 disclosed reports; latest 2025-07-21. Updated 2026-10-23._

## How it works
An endpoint reachable without login passes attacker-controlled request data into a sink that treats it as trusted: a deserializer, a JDBC connection URI, or a command. The broken assumption is that reaching the sink implies the caller is trusted. Authentication lives elsewhere (routing config, a header check, a token that should have been deleted), so the sink itself has no gate and no type/format restriction.

## Where it shows up
- Handlers reachable without a session: `.ashx`/`.aspx`, `/api/setup/*`, JSON web-service endpoints, report/export handlers.
- Request body or headers flowing into `ReadObject`, `Deserialize`, `NetDataContractSerializer`, or similar.
- JDBC/connection URIs accepted from request parameters, especially H2 or drivers with dangerous options.
- Setup/install tokens still present after setup completes.
- Auth enforced only by routing config or a `Referer`/header check.
- WAF and backend disagreeing on URL decoding, letting encoded traversal reach a wildcard route.

## How to review
For each unauthenticated route, trace request data to every sink. The invariant: no pre-auth request value may reach a deserializer, connection URI, or command without a type/allowlist restriction, and the sink must not trust caller-supplied types or URIs. Check that setup tokens are deleted post-install, that auth is enforced in code not just config, and that header-based checks cannot be forged. Confirm the WAF and origin decode URLs identically.

## Variants seen
- Leftover setup token plus JDBC URI SQL injection (H2 driver) for pre-auth RCE [E1](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-chaining-our-way-to-pre-auth-rce-in-metabase-cve-2023-38646.md).
- WAF encoding bypass reaching a wildcard-routed JSON web service with typed parameter instantiation [E2](https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md).
- Unauthenticated `.ashx` handler deserializing XML with no type restrictions [E3](https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-sitecore-experience-platform-pre-auth-rce-cve-2021-42237.md).
- Forged `Referer` auth bypass feeding unsafe deserialization [E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-sharepoint-vulnerabilities-cve-2025-53770-cve-2025-53771-everything-you-need-to-k.md).

## Why fixes fail
E4 shows both flaws were incomplete-fix bypasses: after patching, alternate header values and forged signed payloads still worked. E1's token deletion was removed by a later refactor.

## Impact and severity
Full pre-auth RCE in every case, leading to web shells and machineKey theft [E4](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-sharepoint-vulnerabilities-cve-2025-53770-cve-2025-53771-everything-you-need-to-k.md). Severity is critical; it worsens when secrets sit in readable configs or keys carry excessive permissions.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-chaining-our-way-to-pre-auth-rce-in-metabase-cve-2023-38646.md
- E2: https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md
- E3: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-sitecore-experience-platform-pre-auth-rce-cve-2021-42237.md
- E4: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-sharepoint-vulnerabilities-cve-2025-53770-cve-2025-53771-everything-you-need-to-k.md