TLDR Tech / InfoSec
P4WNED: How Insecure Defaults in Perforce Expose Source Code Across the Internet
Public scans of 6,121 Perforce servers found that 72% allowed unauthenticated read access, 21% exposed read-write paths, and 4% had passwordless super‑user accounts with potential for trigger-based RCE. The research walks through five default misconfigurations: auto account creation, unauthenticated user listing, passwordless accounts, self‑service initial passwords, and a now-patched hidden “remote” user that enabled remote‑depot sync without auth. It then shows real exposures across game studios, medical and financial vendors, government, and supply‑chain providers, and provides concrete p4 configure baselines (security=4, dm.user.noautocreate=2, dm.user.setinitialpasswd=0, and others) plus open-source tools (P4WNED, P4GHOST, Nuclei templates, and Metasploit modules) to let you audit and lock down any P4 footprint.
Read the full story