Mikhail Shcherbakov

Also planning to finally drop those promised threads in the coming weeks: my V8 exploit dev journey, some client-side #bugbountytips, and maybe more depending on what I dig up from my old notes ✍️

Due to vacation, June (and probably July) don't bring many reports:
- 1 Crit reported;
- 1 Crit 9.9 😎 (
@elastic.co
fixed the #RCE chain behind my CVE-2025-2135 exploit discuss.elastic.co/t/kibana-7-1... and CVE-2025-25012 discuss.elastic.co/t/kibana-7-1...);
- 1 new Medium closed as Informative.

Looks like now's the right time to finally dive in! The threat model for extensions looks promising for BB. postMessage() alone opens up new attack variations that don't exist in classic client-side apps 💡

Let's see what I can find in this space 👀

🌊 2025 YTD #BugBounty stats update, June:

📄 13 issues Reported (5 Crit, 2 High, 6 Medium)
💰 10 issues Paid
⚪ 1 Informative

Late update this time, just came back from vacation and started digging for new targets to research. I've had my eye on browser extensions for a while.

YouTube video by DEFCONConference DEF CON 32 - Exploiting the Unexploitable Insights from the Kibana Bug Bounty - Mikhail Shcherbakov

@shaunau.bsky.social If you haven't seen my previous talk about Kibana RCEs (it doesn't cover these ones), you might find it interesting, especially if you're into tricky Prototype Pollution exploits. Check it out youtu.be/H-bhmSwnRdY?...

Yeah, many Kibana RCEs I reported are beautiful. They implemented a lot of mitigations I had to bypass 😁 I'd love to share details, but for this bug it's too early. I'm also too lazy for blog posts, usually just drop stuff at conferences. Definitely need to do one more talk on Kibana RCEs.

If there's interest, I might write a thread on the resources that I used to dev my own Chrome RCE exploit.

Also, if you have an SSRF in Chrome 134 in a BBP, DM me. It could be a great collab to turn the report into a full RCE 🤝

#bugbounty #infosec #rce #chromium #v8

- Open-source repo = easy diffs for n-days
- Regression tests (if you're lucky) help a lot
- Controlled JS = powerful primitives, e.g., heap- & jit- spraying
- V8 sandbox adds that spicy edge 🌶️

I played with Chrome vulns back in Jan, mostly trying to reproduce n-days. In May, I found promising targets and developed an RCE from scratch to reverse shell in Chromium 134.

Low-level exploits are real fun 🔥 and Chromium is an awesome playground for them:

🤓 2025 YTD #BugBounty stats update, May:

📄 11 issues Reported (4 Crit, 2 High, 5 Medium)
💰 9 issues Paid

A new month means 2 more RCEs reported 👌
This time I hit Chromium headless browser for the first time in BBPs.

So yeah, I've started thinking about switching back to industry and ending the full-time BB experiment. Don't be surprised if that happens in the next couple of months, it'll just mean the dark side with cookies and performance reviews won this round 😅

Hitting my Q1 milestone of earning the same as I would've by signing my last job offer definitely gives me motivation to push even harder. That said, my current efforts haven't led to any big breakthroughs in my BB methodology.

Still, it opens up more opportunities that I'm trying to take advantage of. I'm investing time into researching new types of attacks and building out automation.

This is really the kind of life I enjoy: taking risks and being fully responsible for everything that happens!

The first financial goal, reaching income comparable to a full-time IT job, is achieved!

Two RCEs with a bit of "collateral damage" per month has been enough to make it work, though I won't lie, it's way more stressful.

In April, I reported 2 #RCE (consistency 😎), and once again, one of them was classified as Medium. Fine, move on. Many previously reported vulns also got paid this month 💸

I've been doing BB full-time since late last year, so it's a good moment to sum things up.

If I have extra time, I go through old notes and mine a few more, usually with less critical severity. As you can see, some RCEs end up being classified as Medium due to BBP restrictions... but even then, the bounties were not too bad.

👌 2025 YTD #BugBounty stats update, April:

📄 9 issues Reported (2 Crit, 2 High, 5 Medium)
💰 8 issues Paid

Switched to monthly updates instead of weekly. Why? I don't drop new vulns every week 😅 My stats from the last months confirm my "capacity": ~2 RCEs per month.

RCE in Elastic Kibana via Prototype Pollution (CVSS 9.9) 🚀 www.cve.org/CVERecord?id...

RCE in Elastic Kibana via Prototype Pollution (CVSS 8.7) 🤔 Curious about the A:N in the vector for the RCE... typo or did I miss something?.. www.cve.org/CVERecord?id...

Unrestricted File Upload in Elastic Kibana (CVSS 5.4). Part of another chain ending in XSS and showing ATO impact. I shared some details at my last DEF CON, but the deep dive is still in the vault. Looks like I've hoarded enough CVEs for the next talk 😅 www.cve.org/CVERecord?id...

Unrestricted File Upload in Elastic Kibana. Part of the most beautiful and non-trivial chain I've built. I'm excited to get a chance to share the full story in a con talk someday 🤞 www.cve.org/CVERecord?id...

RCE in Elastic Kibana via Prototype Pollution (CVSS 9.1) 🔥 www.cve.org/CVERecord?id...

Just noticed @elastic.co shipped a bunch of CVEs for the 0-days I reported. Threading them here for memory and tipping my hat to the Elastic Security Team ❤️ top-tier BBP and meticulous triage. Highly recommended for Bug Hunters 😎
#bugbounty #0day #rce

🫡 2025 YTD #BugBounty stats update, March:

📄 7 issues Reported (2 Crit, 1 High, 4 Medium)
💰 2 issues Paid

Reported 2 RCEs and some "collateral damage" for March. Still investigating new targets and developing my own tools.

I also agree that there are cases where RCE can be an expected issue,eg via ffmpeg in an isolated container. My concern is about changing the reported CVSS without any clarification. An RCE can be paid as Medium if it affects a non-priority target (and BBP says it),but this fact does not affect CVSS

I agree. I remember @ajxchapman.bsky.social had an even worse case where an RCE was classified as Low, right? Did you try requesting mediation/support from the platform? Did it help?

That’s an open source web app in the BB scope of a big corporation 😶 I cann’t say exactly since it’s not fixed yet. Once it’s patched, I definitely want to share the details. Let’s see how it ends up! Still hoping they’re open to discussion and will fix not just the bug but its severity as well 😀

- DDay was right: "Finding Bugs is Easy – Finding Scope is Hard." If you haven't read one of the best BB stories yet, go enjoy it: douglas.day/2024/12/13/H...

- Time to expand beyond classic web app targets. Need to invest in learning new threat models, technologies, and attack surfaces. Balancing BBPs with learning new things is hard, but gotta keep pushing!

Need to figure out how to leverage H1/Bugcrowd/Immunefi APIs to pull new targets for analysis automatically instead of wasting time on it.