# Pre-auth input reaching injection sinks

Unauthenticated params, cookies or paths reaching SQL, deserialization, include or template sinks before auth stops execution

_Area: Web injection and code execution. Seen in 2 disclosed reports; one confirmed bounty: $20,000; latest 2022-10-28. Updated 2026-11-02._

## How it works
The assumption that breaks is "dangerous code only runs after authentication." In practice a request-controlled value reaches the sink on a path that runs before, or instead of, the auth gate. The gate may be missing, its failure branch may not halt execution, or a front-end proxy/WAF may decode and normalize the URL differently from the backend, so a request that looks benign outside is routed into a privileged handler inside. Once request-controlled input reaches a SQL string, a typed-object instantiator, an include path, or a template, the sink is exercised without a login.

## Where it shows up
- Auth checks whose return value is discarded, e.g. `$user = new user(true);` with no `exit`/`return` on failure [E2](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-juniper-sslvpn-junos-rce-and-multiple-vulnerabilities.md)
- Filename/path sanitizers that block `/` but not `\`, or that run before later normalization [E2](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-juniper-sslvpn-junos-rce-and-multiple-vulnerabilities.md)
- Query tokens concatenated into `require_once`/include paths [E2](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-juniper-sslvpn-junos-rce-and-multiple-vulnerabilities.md)
- Proxy routing rules with wildcards (`/group/control_panel*`) that a crafted path can satisfy [E1](https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md)
- WAF and backend disagreeing on URL decoding (`%2e%2e%3b`, `;` stripping, `../` normalization) [E1](https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md)
- Web-service endpoints that instantiate classes from typed request parameters, reachable pre-auth through a bypass chain [E1](https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md)
- Known-CVE traversal paths like `/+CSCOU+/../+CSCOE+/` on edge VPN appliances [E3](https://bugbountylibrary.com/r/h1%3A694865.md)

## How to review
Trace every unauthenticated entry point to its sink and confirm an explicit stop on the failure branch. The invariant: no request-controlled value reaches a SQL string, object instantiator, include path, or command until an auth check has both succeeded and halted execution otherwise. For each sink ask: is the value parameterized/escaped, and is the auth gate on the same path? For proxied targets, compare how the WAF, load balancer, and app server each decode and normalize the path; a mismatch is the bug. For abandoned plugins, read the source directly rather than trusting the live site.

## How finders spotted it
- Noticed `;` on a jkstatus endpoint, reviewed 84 load-balancer routing maps, spotted a `/group/control_panel*` wildcard, and hypothesized that `..;` encoding would pass the WAF but be decoded and normalized by the backend [E1](https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md)
- Source review of the PHP codebase: saw `new user(true)` not exiting on failed auth, a sanitizer blocking only forward slashes, and unsanitized tokens concatenated into `require_once` [E2](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-juniper-sslvpn-junos-rce-and-multiple-vulnerabilities.md)
- Scanned a large IP range for a known CVE signature and fingerprinted the ASA login page to confirm an unpatched instance [E3](https://bugbountylibrary.com/r/h1%3A694865.md)

## Variants seen
- WAF/proxy encoding bypass chained into pre-auth typed-object instantiation RCE [E1](https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md)
- Auth-check-without-exit enabling pre-auth phar deserialization [E2](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-juniper-sslvpn-junos-rce-and-multiple-vulnerabilities.md)
- Path traversal in an appliance web server exposing files unauthenticated [E3](https://bugbountylibrary.com/r/h1%3A694865.md)

## Impact and severity
Ranged from file/session disclosure [E3](https://bugbountylibrary.com/r/h1%3A694865.md) to full pre-auth RCE [E1](https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md)[E2](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-juniper-sslvpn-junos-rce-and-multiple-vulnerabilities.md). Impact rose when a low-severity leak (jkstatus info) was chained with proxy bypass and wildcard routing to reach RCE [E1](https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md), and when upload path traversal plus `jrest.php` LFI combined into RCE [E2](https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-juniper-sslvpn-junos-rce-and-multiple-vulnerabilities.md).

## Seen in real software
Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix.
- **Junos OS** (J-Web) fixed in 19.1R3-S9, 19.2R3-S6, 19.3R3-S7, 19.4R3-S9, 20.1R3-S5, 20.2R: Juniper SSLVPN / JunOS RCE and Multiple Vulnerabilities (CVE-2022-22241, CVE-2022-22242). Report: https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-juniper-sslvpn-junos-rce-and-multiple-vulnerabilities.md

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Avsrc-vng-com-vn-blog-liferay-revisited-a-tale-of-20k.md
- E2: https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-juniper-sslvpn-junos-rce-and-multiple-vulnerabilities.md
- E3: https://bugbountylibrary.com/r/h1%3A694865.md