Editorial
A publishing web app lets us preview a book cover from a URL, giving a blind SSRF that we use to port-scan localhost and reach an internal API on port 5000. One of its endpoints leaks dev credentials for SSH. In dev's home a Git repo's history exposes a second set of credentials for the prod user. prod may run a GitPython clone script as root; GitPython 3.1.29 is vulnerable to CVE-2022-24439, an ext:: URL RCE, used to run a reverse shell as root.