# Pre-auth input to dangerous sink

Unauthenticated request params reaching SQL, file read/write, deserialization, or agent-load sinks without allowlisting

_Area: Web injection and code execution. Seen in 2 disclosed reports; one confirmed bounty: $5,000; latest 2024-06-18. Updated 2026-11-02._

## How it works
A request parameter that needs no login reaches a sink that was built assuming trusted input: a SQL string, a file path, a driver's file-write, or a JMX/agent-load operation. The broken assumption is that the sink is only reachable by trusted callers or only fed safe values. When the parameter is concatenated, resolved as a path, or handed to a driver/connector that can write files or fetch URLs, the attacker controls the sink directly. The pre-auth part removes the usual gate, so the only remaining barrier is whether the sink itself validates input.

## Where it shows up
- POST/GET params concatenated into SQL without parameterization, especially in admin-ajax or reorder endpoints [E3](https://bugbountylibrary.com/r/h1%3A135288.md)
- Path segments like `/dana-na/../` that resolve outside the intended directory before auth [E2](https://bugbountylibrary.com/r/h1%3A696276.md)
- Managed services that let users pick JDBC drivers or sink connectors with file-write or URL-fetch capability [E1](https://bugbountylibrary.com/r/h1%3A1547877.md)
- Connectors that can reach localhost, where internal admin interfaces (Jolokia/JMX) sit unprotected [E1](https://bugbountylibrary.com/r/h1%3A1547877.md)
- Abandoned or removed plugins still installed on production [E3](https://bugbountylibrary.com/r/h1%3A135288.md)

## How to review
For each unauthenticated entry point, trace the parameter to every sink. The invariant: no pre-auth value may reach a SQL string, file path, driver write, URL fetch, or agent-load without an allowlist or parameterization. Check that path resolution is confined to the intended root after normalization, that JDBC/connector drivers cannot write arbitrary files, and that localhost-only admin endpoints require auth. For SQL, confirm every query uses bound parameters, not string concatenation [E3](https://bugbountylibrary.com/r/h1%3A135288.md). For file reads, confirm traversal sequences are rejected after canonicalization [E2](https://bugbountylibrary.com/r/h1%3A696276.md). For managed connectors, confirm driver and sink choices are restricted and internal endpoints are authenticated [E1](https://bugbountylibrary.com/r/h1%3A1547877.md).

## How finders spotted it
- Noticed an outdated WordPress version, enumerated plugins, found one removed from the repository, pulled its source from SVN, and audited the reorder handler for unescaped POST params [E3](https://bugbountylibrary.com/r/h1%3A135288.md)
- Recognized the target ran Pulse Secure and replayed the published traversal path against the instance [E2](https://bugbountylibrary.com/r/h1%3A696276.md)
- Realized the SQLite JDBC driver enables file writes, noticed the HTTP sink can reach localhost, found unprotected Jolokia, and identified an agent-loading primitive [E1](https://bugbountylibrary.com/r/h1%3A1547877.md)

## Variants seen
- SQL injection via concatenated POST params in an abandoned plugin [E3](https://bugbountylibrary.com/r/h1%3A135288.md)
- Pre-auth path traversal file read chained to credential theft and command injection [E2](https://bugbountylibrary.com/r/h1%3A696276.md)
- Driver file-write plus SSRF to internal JMX for agent-load RCE [E1](https://bugbountylibrary.com/r/h1%3A1547877.md)

## Impact and severity
E3 yielded time-based DB extraction from an unauthenticated request. E2 turned a pre-auth file read into cleartext credential theft, then authenticated command injection to root and intranet access; impact rose because credentials were stored in cleartext and the appliance faced the internet. E1 reached RCE on a managed Kafka service by chaining two connector features to an internal-only endpoint; impact rose because the internal admin interface was unauthenticated and the driver could write files. Severity is highest when the pre-auth sink is internet-facing and chains to a second weakness (credential reuse, internal admin, or agent loading).

## Evidence
- E1: https://bugbountylibrary.com/r/h1%3A1547877.md
- E2: https://bugbountylibrary.com/r/h1%3A696276.md
- E3: https://bugbountylibrary.com/r/h1%3A135288.md