#code-injection

Analysis · May 20, 2026 · Colten Anderson

When a vulnerability is shaped exactly like a backdoor

CVE-2021-44529 triggers when you send Ivanti's appliance a cookie that says 'ab' followed by base64 the server decodes and runs. That's not what an accidental bug looks like. Whether it was planted or just terrible code, the lesson about dependency provenance is the same.