Giacomo Lenzini

From Misconfiguration to RCE: A Deep Dive into Nextcloud Security ☁️

Mon, 03 Nov 2025 20:00:00 +0000

During a recent penetration test, I came across a misconfigured Nextcloud instance. With the appropriate permissions, it was possible to achieve Remote Code Execution (RCE) in two distinct ways by leveraging built-in Nextcloud functionality. This post walks through the attack surface and outlines defensive measures.

Nextcloud is an open-source platform for file storage, collaboration, and communication. It allows users to sync files, share documents, manage calendars, and collaborate securely across devices and teams. In many ways, Nextcloud resembles popular cloud services such as Google Drive or Dropbox, but it offers the key advantage of complete data ownership and enhanced privacy.

Spatial VDP: How I Rocked-Boosted a NASA XSS from P5 to P2 🚀

Tue, 13 May 2025 00:00:00 +0000

A few months ago, I read an intriguing article by Valerio “MrSaighnal” Alessandroni, detailing how he earned a letter of acknowledgment from NASA for reporting a vulnerability. That story stuck with me.

NASA’s Vulnerability Disclosure Program (VDP) is a non-monetary initiative that invites security researchers to report vulnerabilities in NASA’s public-facing systems. Unlike traditional bug bounties, the reward is purely ethical hacking glory – but with a cosmic twist.

For valid P3 or higher vulnerabilities, researchers receive:

Mon, 01 Jan 0001 00:00:00 +0000

Who am i

I am a 25-year-old guy graduate in cybersecurity, currently working as an Offensive Security Specialist. In my role, I perform various types of penetration tests to strengthen the security posture of organizations. In my spare time, I actively participate in Bug Bounty programs and engage in Capture The Flag (CTF) challenges and practice on various vulnerable labs (HackTheBox) to enhance my skills in ethical hacking and red teaming. I am also passionate about sports, having practiced kickboxing for 13 years, including 10 years at a competitive level. Currently, I practice CrossFit to maintain my fitness and discipline.