Simon Gerst

Germany

Simon is a Computer Science student that loves tearing apart software to find security bugs. He wants to share his knowledge and also his CodeQL queries, to perform bug hunting at scale. He mostly finds bugs in OSS and contributes to the GitHub Security Lab Bug Bounty Program. In his free time he enjoys playing piano.

Community Contributions

Latest Blog posts Open source

From Arbitrary File Write to RCE Using Git Hooks

I found an issue in fossasia/susi_server that could be used to achieve remote code execution. I'm showing step by step, how - after some failed attempts - I achieved remote code execution by using Git (pre)-commit hooks.

Blogpost / 07-18-2021

CodeQL: Add JWT without signature check query for Java

I added a CodeQL query that checks for JWT parsing without signature checks. Using the query I found and disclosed 4 CVEs.

Open source project / 04-04-2021

CodeQL: Add insecure JXBrowser query

I added a CodeQL query that looks for insecure uses of Teamdev's JXBrowser in versions <= 6.23.1.

Open source project / 01-12-2021

CodeQL: Add insecure trustmanager query for Java

I added a CodeQL query that looks for insecure `TrustManager`s. Using the query I found and disclosed 4 CVEs.

Open source project / 12-25-2020

CodeQL: Add unsafe hostname verification query for Java

I added a CodeQL query that looks for unsafe hostname verification issues in Java. Using the query I found and disclosed 4 CVEs.

Open source project / 12-02-2020

Integrate rdkit into Google's oss-fuzz

I wrote fuzzers for rdkit/rdkit, a collection of cheminformatics and machine-learning software, and integrated them into Google's oss-fuzz where the fuzzers are continuously run and looking for bugs.

Open source project / 06-10-2020

CodeQL: Add XPath injection query for Go

I implemented a CodeQL query that looks for XPath injections.

Open source project / 03-19-2020

Related Stars