Veeam fixed an Unauth RCE (CVE-2022-26500, CVE-2022-26501) in Veeam Backup & Replication and Local Privilege Escalation (CVE-2022-26503) in Veeam Agent for Microsoft Windows found by our researcher Nikita Petrov.
Advisory: https://www.veeam.com/kb4288
Advisory: https://www.veeam.com/kb4288
👍17
Rapid7 fixed an SQL-Injection (CVE-2022-0757) and an XSS (CVE-2022-0758) in Nexpose Vulnerability Scanner found by our researcher Aleksey Solovev.
Advisory: https://docs.rapid7.com/release-notes/nexpose/20220302/
Advisory: https://docs.rapid7.com/release-notes/nexpose/20220302/
👍13
Ruby Deserialization - Gadget on Rails
👤 by Harsh Jaiswal
In this writeup research team went over the current state of previous ruby deserialization gadget chains and the process of finding new RCE gadgets. Researchers went over the fixes of previous gadget chains and found a new way to achive remote code execution on latest Rails framework.
📝 Contents:
• Motivation
• Pre-Requisite
• Current State of Previous Gadgets
• File Write and File Execution Gadget
•• BackStory
•• Initial File Write
• Moving away from DeprecatedInstanceVariableProxy class
•• How we initiated the search?
•• Latest Rails Remote Code Execution Gadget
• Conclusion
https://github.com/httpvoid/writeups/blob/main/Ruby-deserialization-gadget-on-rails.md
👤 by Harsh Jaiswal
In this writeup research team went over the current state of previous ruby deserialization gadget chains and the process of finding new RCE gadgets. Researchers went over the fixes of previous gadget chains and found a new way to achive remote code execution on latest Rails framework.
📝 Contents:
• Motivation
• Pre-Requisite
• Current State of Previous Gadgets
• File Write and File Execution Gadget
•• BackStory
•• Initial File Write
• Moving away from DeprecatedInstanceVariableProxy class
•• How we initiated the search?
•• Latest Rails Remote Code Execution Gadget
• Conclusion
https://github.com/httpvoid/writeups/blob/main/Ruby-deserialization-gadget-on-rails.md
X (formerly Twitter)
Harsh Jaiswal (@rootxharsh) on X
Building @hacktronai | researching at @httpvoid0x2f | auditing at
@cure53berlin | prev @zomato @vimeo @pdiscoveryio
@cure53berlin | prev @zomato @vimeo @pdiscoveryio
👍7
🔥We have reproduced the fresh CVE-2022-22954 Server-Side Template Injection in VMware Workspace ONE Access.
Successful exploitation could lead to RCE from an unauthenticated user.
Patch ASAP!
Successful exploitation could lead to RCE from an unauthenticated user.
Patch ASAP!
👍18
HPE fixed two vulnerabilities in OneView found by our researcher Nikita Abramov.
1️⃣ CVE-2022-23699 - Authentication Restriction Bypass
2️⃣ CVE-2022-23700 - Unauthorized Read Access to Files
Find out more ➡️ https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04252en_us
1️⃣ CVE-2022-23699 - Authentication Restriction Bypass
2️⃣ CVE-2022-23700 - Unauthorized Read Access to Files
Find out more ➡️ https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04252en_us
👍5
New version of reFlutter is available to download!
Now reFlutter not only allows you to monitor traffic, but also shows absolute offsets of the functions in the target Android or iOS application. Root is not required.
https://github.com/Impact-I/reFlutter
Now reFlutter not only allows you to monitor traffic, but also shows absolute offsets of the functions in the target Android or iOS application. Root is not required.
https://github.com/Impact-I/reFlutter
👍14
💎Cisco fixed an Authenticated Heap Overflow Vulnerability (CVE-2022-20737) in Cisco ASA found by our researcher Nikita Abramov.
The vulnerability allows an attacker to cause a DoS or to obtain portions of process memory from the device.
The advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssl-vpn-heap-zLX3FdX
The vulnerability allows an attacker to cause a DoS or to obtain portions of process memory from the device.
The advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asa-ssl-vpn-heap-zLX3FdX
👍9
⚠️Synacor fixed an Authenticated RCE (CVE-2022-27925) in Zimbra Collaboration Suite found by our researcher Mikhail Klyuchnikov.
So far, no advisory, but the patch is available: https://wiki.zimbra.com/wiki/Security_Center
So far, no advisory, but the patch is available: https://wiki.zimbra.com/wiki/Security_Center
👍5
New research by Alexander Popov: "A Kernel Hacker Meets Fuchsia OS"
Fuchsia OS is based on the Zircon microkernel and developed by Google. Alexander assessed it from the attacker's point of view.
Read the article: https://swarm.ptsecurity.com/a-kernel-hacker-meets-fuchsia-os/
Fuchsia OS is based on the Zircon microkernel and developed by Google. Alexander assessed it from the attacker's point of view.
Read the article: https://swarm.ptsecurity.com/a-kernel-hacker-meets-fuchsia-os/
👍14
From open redirect to RCE in one week
👤 by Anton ???
In this write-up the author tells a story of chaining multiple vulnerabilities to achieve RCE on several hosts of Mail.ru (VK). The exploit chain consists of following bugs: Open Redirect, Unsafe Deserialization, Kohana hack, LFI for Logs.
📝 Contents:
* Intro
* Functionality that caught my attention
* Possible scenarios
* Open redirect
* Deserialization
* Kohana
* Chaining all together
* Logs
* Null bytes
* Last poison
https://medium.com/@byq/from-open-redirect-to-rce-in-one-week-66a7f73fd082
👤 by Anton ???
In this write-up the author tells a story of chaining multiple vulnerabilities to achieve RCE on several hosts of Mail.ru (VK). The exploit chain consists of following bugs: Open Redirect, Unsafe Deserialization, Kohana hack, LFI for Logs.
📝 Contents:
* Intro
* Functionality that caught my attention
* Possible scenarios
* Open redirect
* Deserialization
* Kohana
* Chaining all together
* Logs
* Null bytes
* Last poison
https://medium.com/@byq/from-open-redirect-to-rce-in-one-week-66a7f73fd082
X (formerly Twitter)
Anton (@ByQwert) on X
sometimes I break something
👍19
Active Exploitation of Confluence CVE-2022-26134
👤 by Rapid7
On June 2, 2022, Atlassian published a security advisory for CVE-2022-26134, a critical unauthenticated remote code execution vulnerability in Confluence Server and Confluence Data Center. The vulnerability was unpatched when it was published on June 2. As of June 3, both patches and a temporary workaround are available.
CVE-2022-26314 is an unauthenticated and remote OGNL injection vulnerability resulting in code execution in the context of the Confluence server (typically the confluence user on Linux installations). Given the nature of the vulnerability, internet-facing Confluence servers are at very high risk.
📝 Contents:
• Technical analysis
•• The vulnerability
•• Root cause
•• The patch
•• Payloads
• Mitigation guidance
https://www.rapid7.com/ja/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/
👤 by Rapid7
On June 2, 2022, Atlassian published a security advisory for CVE-2022-26134, a critical unauthenticated remote code execution vulnerability in Confluence Server and Confluence Data Center. The vulnerability was unpatched when it was published on June 2. As of June 3, both patches and a temporary workaround are available.
CVE-2022-26314 is an unauthenticated and remote OGNL injection vulnerability resulting in code execution in the context of the Confluence server (typically the confluence user on Linux installations). Given the nature of the vulnerability, internet-facing Confluence servers are at very high risk.
📝 Contents:
• Technical analysis
•• The vulnerability
•• Root cause
•• The patch
•• Payloads
• Mitigation guidance
https://www.rapid7.com/ja/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/
👍5
💥 We have reproduced CVE-2022-31626, an RCE in PHP <= 7.4.29 which can be triggered via a rogue MySQL/MariaDB server!
It's a Heap Overflow, works with MySQLi/PDO, and doesn't require LOAD LOCAL INFILE.
The PoC 👉https://github.com/CFandR-github/PHP-binary-bugs/tree/main/cve_2022_31626_remote_exploit
It's a Heap Overflow, works with MySQLi/PDO, and doesn't require LOAD LOCAL INFILE.
The PoC 👉https://github.com/CFandR-github/PHP-binary-bugs/tree/main/cve_2022_31626_remote_exploit
👍13
🧩 Zoneminder fixed a Post-Auth RCE found by our researcher Ilya Yatsenko (@fulc2um).
See details in the advisory 👉https://github.com/ZoneMinder/zoneminder/releases/tag/1.36.16
See details in the advisory 👉https://github.com/ZoneMinder/zoneminder/releases/tag/1.36.16
👍17
Account hijacking using "dirty dancing" in sign-in OAuth-flows
👤 by Frans Rosén
Combining response-type switching, invalid state and redirect-uri quirks using OAuth, with third-party javascript-inclusions has multiple vulnerable scenarios where authorization codes or tokens could leak to an attacker. This could be used in attacks for single-click account takeovers. Frans Rosén, Security Advisor at Detectify goes through three different scenarios found in the wild below and also suggests ways to reduce the risk.
📝 Contents:
• Background
• Current state and assumptions about OAuth credential leakage
• Explanation of different OAuth-dances
• Response modes
• A theory: stealing tokens through postMessage
• It took a lot of time to get here
• Non-happy paths in the OAuth-dance
• Break state intentionally
• Response-type/Response-mode switching
• Redirect-uri case shifting
• Redirect-uri path appending
• Redirect-uri parameter appending
• Redirect-uri leftovers or misconfigurations
• I ended up on a non-happy path. Now what?
• Here be more time
• URL-leaking gadgets
• Other ideas for leaking URLs
• A page on a domain that routes any postMessage to its opener
• Conclusion
• How can we fix this?
• How to reduce the risk
https://labs.detectify.com/2022/07/06/account-hijacking-using-dirty-dancing-in-sign-in-oauth-flows/
👤 by Frans Rosén
Combining response-type switching, invalid state and redirect-uri quirks using OAuth, with third-party javascript-inclusions has multiple vulnerable scenarios where authorization codes or tokens could leak to an attacker. This could be used in attacks for single-click account takeovers. Frans Rosén, Security Advisor at Detectify goes through three different scenarios found in the wild below and also suggests ways to reduce the risk.
📝 Contents:
• Background
• Current state and assumptions about OAuth credential leakage
• Explanation of different OAuth-dances
• Response modes
• A theory: stealing tokens through postMessage
• It took a lot of time to get here
• Non-happy paths in the OAuth-dance
• Break state intentionally
• Response-type/Response-mode switching
• Redirect-uri case shifting
• Redirect-uri path appending
• Redirect-uri parameter appending
• Redirect-uri leftovers or misconfigurations
• I ended up on a non-happy path. Now what?
• Here be more time
• URL-leaking gadgets
• Other ideas for leaking URLs
• A page on a domain that routes any postMessage to its opener
• Conclusion
• How can we fix this?
• How to reduce the risk
https://labs.detectify.com/2022/07/06/account-hijacking-using-dirty-dancing-in-sign-in-oauth-flows/
👍6👎1