The Code Log
Welcome to my blog, a space where I share insights, lessons, and best practices from building secure, scalable web applications and SaaS solutions. From tackling complex development challenges to exploring modern tools, frameworks, and security techniques, this is where I document what works, what doesn’t.
docker.sock Mounted in a Container: Escaping to Root on the Host via the Docker API
The container runs as root and mounts `/var/run/docker.sock`, turning Post #2 RCE into full host compromise. With no docker binary and no credentials, an attacker curls the Docker HTTP API over the Unix socket, creates a privileged container with the host root filesystem mounted at `/mnt/host`, and chroots in as `uid=0` on the host. Covers why only the root `dvla-admin` container can open the socket (the non-root `dvla-horizon` worker cannot), and the fixes: remove the mount, run non-root, use a socket proxy, or switch to rootless Docker or Podman.
Redis with No Authentication: How Your Laravel Horizon Queue Worker Becomes a Backdoor
Redis service runs with no password on the built-in default ACL user, so anyone on the internal dvla-net can RPUSH a job straight into the Horizon queue. Because Laravel's queue worker rebuilds each job with unserialize(), a phpggc gadget chain dropped into data.command executes the moment the worker pops it, no APP_KEY or admin session required. This post walks the full chain, from enumerating Redis through confirming worker-level RCE (Monolog/RCE8) and landing a reverse shell.
SSRF in Laravel: How a 'Fetch Banner from URL' Feature Bridges Into the Internal Network
A blog editor's 'fetch banner from a URL' shortcut calls Http::get() on whatever you type, with no scheme, host, or IP checks, so an admin session becomes a free port scanner for the internal Docker network. Each error that comes back is an oracle: an empty reply means Redis, a refused connection means a closed port, and a clean 200 means you can read whatever's on the other end. Pair it with Post 1's mass-assignment bug and Redis is one polite form field away, no shell required.
