Exploiting CSP in Webkit to Break Authentication & Authorization

👤 by Sachin/Prakash

The bug in the CSP implementation of WebKit, a browser engine used by Safari web browser lead to that an attacker able to steal codes/access_tokens or any other secrets that were part of the leaked URI& This allowed to carry out attacks including but not limited to account takeovers, CSRF, and sensitive information disclosure.

📝 Contents:
• TLDR;
• Single Sign-On (SSO)
• Content Security Policy (CSP)
• CSP Violation Reports
• Root Cause of the Vulnerability
• How can this be exploited in SSO
• Responsible Disclosure to Safari
• Setting up PoC
• Playground
• Impact
• Roadblocks
• Stats
• Fixes
• Browsers' Mitigation Strategies
• Bypasses & a new 0day
• DEMO
• Key Takeaways
• Timeline

https://threatnix.io/blog/exploiting-csp-in-webkit-to-break-authentication-authorization/

The way to bypass XSS WAF in ASP.NET web applications.

The persistent XSS in any message in vBulletin! Patched from 13 Apr 2021. The vulnerability was found by our researcher
Igor Sak-Sakovskiy.

PoC: [VIDEO="aaa;000"]a[FONT="a onmouseover=alert(location) a"]a[/FONT]a[/VIDEO]

Advisory: https://www.vbulletin.org/forum/showthread.php?t=328715

No CVE, because of: https://twitter.com/ptswarm/status/1463883088589692930

PoC for a stored XSS in MyBB < 1.8.25 (CVE-2021-27279). The vulnerability was found by our researcher Igor Sak-Sakovskiy.

Payload: [email]a@a.a?[email=a@a.a? onmouseover=alert(1) a]a[/email][/email]

Advisory: https://github.com/mybb/mybb/security/advisories/GHSA-6483-hcpp-p75w

RCE 0-day exploit found in log4j, a popular Java logging package

👤 by Free Wortley, Chris Thompson

0-day exploit in the popular Java logging library log4j was discovered that results in Remote Code Execution (RCE) by logging a certain string. This post provides resources to understand the vulnerability and how to mitigate it.


📝 Contents:
• Who is impacted?
• Affected Apache log4j Versions
• Temporary Mitigations
• How the exploit works
• Exploit Requirements
• Example Vulnerable Code
• Exploit Steps
• How you can prevent future attacks

https://www.lunasec.io/docs/blog/log4j-zero-day/

Cache Poisoning at Scale

👤 by Youstin

Even though Web Cache Poisoning has been around for years, the increasing complexity in technology stacks constantly introduces unexpected behaviour which can be abused to achieve novel cache poisoning attacks. In this paper author will present the techniques that he used to report over 70 cache poisoning vulnerabilities to various Bug Bounty programs.


📝 Contents:
• Backstory
• Incorrect Handling of the URL Fragment in Apache Traffic Server (CVE-2021-27577)
• GitHub CP-DoS
• GitLab CP-DoS
• X-Forwarded-Scheme - Rack Middleware
• CP-DoS on Hackerone.com static files
• Single request DoS of www.shopify.com
• Stored XSS on 21 subdomains
• Cloudflare and Storage Buckets
• S3 Bucket
• Azure Storage
• Fastly Host header injection
• Injecting Keyed Parameters
• User Agent Rules
• Illegal Header Fields
• Finding New Headers
• Common headers
• Conclusion

https://youst.in/posts/cache-poisoning-at-scale/

New article "Fuzzing for XSS via nested parsers condition" by our researcher @Psych0tr1a.

This techniques allowed us to find a bunch of vulnerabilities in popular web products that no one had noticed before!

https://swarm.ptsecurity.com/fuzzing-for-xss-via-nested-parsers-condition/

Our research "Fuzzing for XSS via nested parsers condition" is in the Top 10 Web Hacking Techniques of 2021 nomination list. Don't forget to vote for us if you enjoyed the technique 😜

Link for voting: https://portswigger.net/polls/top-10-web-hacking-techniques-2021

Hacking the Apple Webcam (again)

👤 by Ryan Pickren

Gaining unauthorized camera access via Safari UXSS, this research resulted in 4 0day bugs (CVE-2021-30861, CVE-2021-30975, and two without CVEs), 2 of which were used in the camera hack.

📝 Contents:
• Summary
• Background
• The Attack Plan
• Exploration of custom URI Schemes
• Exploit Requirements
• ShareBear Application
• Bonus Bug: Iframe Sandbox Escape
• Quarantine and Gatekeeper
• Shortcuts
• Full Chain
• Remediation
• Bonus Material (#1)
• Bonus Material (#2)
• Conclusion

https://www.ryanpickren.com/safari-uxss

The CFP for Positive Hack Days 2022 is open!

It's time to present your novel techniques/research.

This year the conference will be in a hybrid format (offline and online) both for speakers and participants.

Submit your proposal - https://cfp.phdays.com

A story of leaking uninitialized memory from Fastly

👤 by Emil Lerner

This post will go through a QUIC (HTTP/3) implementation bug in the H2O webserver. The bug is pretty interesting as it affected Fastly in a way that it allowed stealing random requests and responses from uninitialized memory of its’ nodes, somewhat similar to CloudBleed

📝 Contents:
• Setting up a test environment
• Detecting which software is used
• QUIC streams
• Data transfer
• The bug
• The exploit plan
• Exploitation
• Disclosure
• Conclusion

https://medium.com/@emil.lerner/leaking-uninitialized-memory-from-fastly-83327bcbee1f

A Tip for SQL Injection WAF Bypass

New article by our researchers Mikhail Klyuchnikov and Egor Dimitrenko about unauth RCEs in VMware products: "Hunting for bugs in VMware: View Planner and vRealize Business for Cloud".

Read the article: https://swarm.ptsecurity.com/hunting-for-bugs-in-vmware-view-planner-and-vrealize-business-for-cloud/

This is the first article about our VMware research. More to come!

We have reproduced the fresh CVE-2022-24086 Improper Input Validation vulnerability in Magento Open Source and Adobe Commerce.

Successful exploitation could lead to RCE from an unauthenticated user.

We have successfully bypassed the patch for RCE in Magento Open Source and Adobe Commerce (CVE-2022-24086), and have sent the report to Adobe (we weren't the first). The new CVE-2022-24087 was issued. Hotfix is available now.

Patch ASAP!

Relaying Kerberos over DNS using krbrelayx and mitm6

👤 by Dirk-jan Mollema

In scenario, where attacker have the ability to spoof a DNS server via DHCPv6 spoofing with mitm6, he can get victim machines to reliably authenticate to him using Kerberos and their machine account. This authentication can be relayed to any service that does not enforce integrity, such as Active Directory Certificate Services (AD CS) http(s) based enrollment, which in turn makes it possible to execute code as SYSTEM on that host. This technique is faster, more reliable and less invasive than relaying WPAD authentication with mitm6, but does of course require AD CS to be in use.

📝 Contents:
• Kerberos over DNS
• Abusing DNS authentication
• Changes to krbrelayx and mitm6
• Attack example
• Defenses
• Mitigating mitm6
• Mitigating relaying to AD CS
• Tools

https://dirkjanm.io/relaying-kerberos-over-dns-with-krbrelayx-and-mitm6

Adding save function to impacket's ```reg.py``` for Backup Operators to Domain Admin exploitation

save feature to reg.py allows for remote saving of registry hives. The feature can be used to escalate from Backup Operators to Domain Admin by retrieving a Domain Controller's hives and using them to obtain hash and act as the Domain Controller or as the domain admin directly.
backup method which doesn't mirror an existing function of the original reg cmdlet but instead allows to dump SAM, SYSTEM and SECURITY "at once".

https://github.com/SecureAuthCorp/impacket/pull/1257

New article by our researcher Egor Dimitrenko about unauth vulnerabilities in VMware products: "Catching bugs in VMware: Carbon Black Cloud Workload and vRealize Operations Manager". This is the second in series of our VMware research.

Read the article: https://swarm.ptsecurity.com/catching-bugs-in-vmware-carbon-black-cloud-workload-appliance-and-vrealize-operations-manager/

The Dirty Pipe Vulnerability

👤 by Max Kellermann

This is the story of CVE-2022-0847, a vulnerability in the Linux kernel since 5.8 which allows overwriting data in arbitrary read-only files. This leads to privilege escalation because unprivileged processes can inject code into root processes.
It is similar to CVE-2016-5195 “Dirty Cow” but is easier to exploit.
The vulnerability was fixed in Linux 5.16.11, 5.15.25 and 5.10.102.


📝 Contents:
• Abstract
• Corruption pt. I
• Access Logging
• Corruption pt. II
• Corruption pt. III
• Man staring at code
• Man staring at kernel code
• Pipes and Buffers and Pages
• Uninitialized
• Corruption pt. IV
• Exploiting
• Timeline

https://dirtypipe.cm4all.com

Oracle Access Manager Pre-Auth RCE (CVE-2021–35587 Analysis)

👤 by Jang and Peter

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability may give the attacker access to OAM server, to create any user with any privileges, or just get code execution in the victim’s server

https://testbnull.medium.com/oracle-access-manager-pre-auth-rce-cve-2021-35587-analysis-1302a4542316