CVE-2023-34040 Spring Kafka Deserialization Remote Code Execution

👤 by pyn3rd

In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers.

The researcher described in detail the causes of the vulnerability and the method of its exploitation. This is a perfect example of how a vulnerability can be reproduced only based on information from advisory.

📝 Contents:
● Preface
● Concepts of Kafka
● Preparation

https://pyn3rd.github.io/2023/09/15/CVE-2023-34040-Spring-Kafka-Deserialization-Remote-Code-Execution/

🔥 We have reproduced the fresh CVE-2023-42793 in JetBrains TeamCity.

Authentication bypass allows an external attacker to gain administrative access to the server and execute any commands on it.

Update your software ASAP!

[P2O Vancouver 2023] SharePoint Pre-Auth RCE chain (CVE-2023–29357 & CVE-2023–24955)

👤 by Janggggg

Researcher has achieved successful exploitation of a SharePoint target during Pwn2Own Vancouver 2023. While the live demonstration lasted only approximately 30 seconds, it is noteworthy that the process of discovering and crafting the exploit chain consumed nearly a year of meticulous effort and research to complete the full exploit chain.

This exploit chain leverages two vulnerabilities to achieve pre-auth remote code execution (RCE) on the SharePoint server:
• Authentication Bypass
• Code Injection

📝 Contents:
● Brief
● Affected products/Tested version
● Vulnerability #1: SharePoint Application Authentication Bypass
● Vulnerability #2: Code Injection in DynamicProxyGenerator.GenerateProxyAssembly()
● Demo

https://starlabs.sg/blog/2023/09-sharepoint-pre-auth-rce-chain/

💥 We have reproduced both CVE-2023–29357 and CVE-2023–24955 in Microsoft SharePoint.

The chain allows unauthenticated users to execute arbitrary commands on the server.

Update your software ASAP!

⚠️ We have reproduced CVE-2023-22515 in Atlassian Confluence.

Broken access control allows unauthenticated users to gain administrative access to the web application!

Update your software ASAP!

Citrix Bleed: Leaking Session Tokens with CVE-2023-4966

👤 by Dylan Pindur

It's time for another round Citrix Patch Diffing! Earlier this month Citrix released a security bulletin which mentioned "unauthenticated buffer-related vulnerabilities" and two CVEs. These issues affected Citrix NetScaler ADC and NetScaler Gateway.

Researchers were interested in CVE-2023-4966, which was described as "sensitive information disclosure" and had a CVSS score of 9.4. The high score for an information disclosure vulnerability and the mention of "buffer-related vulnerabilities" piqued their interest. Their goal was to understand the vulnerability and develop a check for their Attack Surface Management platform.

📝 Contents:
● Introduction
● Patch Diffing
● Finding the Vulnerable Function
● Exploiting the Endpoint
● Verifying the Session Token
● Final Thoughts

https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966

Refresh: Compromising F5 BIG-IP With Request Smuggling | CVE-2023-46747

👤 by Michael Weber and Thomas Hendrickson

As a result of the research researchers were able to identify an authentication bypass issue that led to complete compromise of an F5 system with the Traffic Management User Interface (TMUI) exposed. The bypass was assigned CVE-2023-46747, and is closely related to CVE-2022-26377. Like they recently reported Qlik RCE, the F5 vulnerability was also a request smuggling issue. In this blog authors will discuss their methodology for identifying the vulnerability, walk through the underlying issues that caused the bug, and explain the steps they took to turn the request smuggling into a critical risk issue. They will conclude with remediation steps and their thoughts on the overall process.

📝 Contents:
● Overview
● Mapping out the F5 BIG-IP Attack Surface
● F5 Traffic Management User Interface (TMUI) Overview
● Verifying AJP Smuggling
● AJP Smuggling and Server Interpretation
● But What To Do With the Smuggling?
● Remediation
● Conclusion
● Disclosure Timeline

https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/

From Akamai to F5 to NTLM... with love

👤 by d3d

In this post, researcher is going to show the readers how he was able to abuse Akamai so he could abuse F5 to steal internal data including authorization and session tokens from their customers.

📝 Contents:
● Prerequisites
● Discovery
● On the Akamai hunt
● On the F5 hunt
● God Mode Pwnage
● NTLM or GTFO
● Closing

https://blog.malicious.group/from-akamai-to-f5-to-ntlm/

Introducing wrapwrap: using PHP filters to wrap a file with a prefix and suffix

👤 by Charles Fol

wrapwrap marks another improvement to the PHP filter exploitation saga. Adding arbitrary prefixes to resources using php://filter is nice, but you can now add an arbitrary suffix as well, allowing you to wrap PHP resources into any structure. This beats code like:

$data = file_get_contents($_POST['url']);
$data = json_decode($data);
echo $data->message;

or:

$config = parse_ini_file($_POST['config']);

echo $config["config_value"];

📝 Contents:
● Abstract
● Introduction
● Building wrapwrap
• Adding a prefix
• Fuzzing to no effect
• Not so random trimming
• The main idea
• Where is the end?
• Real suffix control: removing digits
● Using wrapwrap
● Conclusion

https://www.ambionics.io/blog/wrapwrap-php-filters-suffix

🌵 Cacti fixed 2 high severity vulnerabilities found by our researcher Aleksey Solovev.

💥 CVE-2023-49084 – RCE via managing links;
💥 CVE-2023-49085 – SQLi via managing poller devices.

Read the technical advisories here ↓
https://github.com/Cacti/cacti/security

New article by our researcher @snovvcrash: "Python ❤️ SSPI: Teaching #Impacket to Respect Windows SSO".

🥷 Read the blog post and you'll fly under the radar of endpoint security mechanisms as well as custom network detection rules more easily.

https://swarm.ptsecurity.com/python-sspi-teaching-impacket-to-respect-windows-sso/

🖥 Yealink fixed a post-auth OS command injection in Yealink Meeting Server found by our researcher.

Read the advisory: https://www.yealink.com/en/trust-center/security-advisories/2f2b990211c440cf

💥 We have reproduced CVE-2023-22527 in Atlassian Confluence.

A template injection vulnerability allows an unauthenticated attacker to achieve RCE on an affected instance.

Update your software ASAP!

Atlassian Confluence - Remote Code Execution (CVE-2023-22527)

👤 by Rahul Maini & Harsh Jaiswal

CVE-2023-22527 is a critical vulnerability within Atlassian's Confluence Server and Data Center. This vulnerability has the potential to permit unauthenticated attackers to inject OGNL expressions into the Confluence Instance, thereby enabling the execution of arbitrary code and system commands.

📝 Contents:
● Technical Details
• Initial Analysis
• Identifying the Unauthenticated Attack Surface
● OGNL Expression Evaluation
● Remote Code Execution via OGNL Injection

https://blog.projectdiscovery.io/atlassian-confluence-ssti-remote-code-execution/

📖 New article by our researcher Nikita Sveshnikov: "Bypassing browser tracking protection for CORS misconfiguration abuse."

Read the blog post to learn how certain misconfigurations can be exploited despite the built-in anti-tracking mechanisms.

https://swarm.ptsecurity.com/bypassing-browser-tracking-protection-for-cors-misconfiguration-abuse/

PortSwigger's Top 10 web hacking techniques of 2023!

Welcome to the Top 10 Web Hacking Techniques of 2023, community-powered effort to identify the most important and innovative web security research published in the last year.

🥇 Smashing the state machine: the true potential of web race conditions
🥈 Exploiting Hardened .NET Deserialization
🥉 SMTP Smuggling - Spoofing E-Mails Worldwide
4️⃣ PHP filter chains: file read from error-based oracle
5️⃣ Exploiting HTTP Parsers Inconsistencies
6️⃣ HTTP Request Splitting vulnerabilities exploitation
7️⃣ How I Hacked Microsoft Teams and got $150,000 in Pwn2Own
8️⃣ From Akamai to F5 to NTLM... with love
9️⃣ Cookie Crumbles: Breaking and Fixing Web Session Integrity
🔟 can I speak to your manager? hacking root EPP servers to take control of zones

The entire nomination list you can find here: https://portswigger.net/research/top-10-web-hacking-techniques-of-2023-nominations-open

CVE-2024-27198 and CVE-2024-27199: JetBrains TeamCity Multiple Authentication Bypass Vulnerabilities (FIXED)

👤 by Rapid7

In February 2024, Rapid7’s vulnerability research team identified two new vulnerabilities affecting JetBrains TeamCity CI/CD server:

• CVE-2024-27198 is an authentication bypass vulnerability in the web component of TeamCity that arises from an alternative path issue (CWE-288) and has a CVSS base score of 9.8 (Critical).

• CVE-2024-27199 is an authentication bypass vulnerability in the web component of TeamCity that arises from a path traversal issue (CWE-22) and has a CVSS base score of 7.3 (High).

📝 Contents:
● Overview
● Impact
● Remediation
● Analysis
• CVE-2024-27198
• CVE-2024-27199
● Rapid7 customers
● Timeline

https://www.rapid7.com/blog/post/2024/03/04/etr-cve-2024-27198-and-cve-2024-27199-jetbrains-teamcity-multiple-authentication-bypass-vulnerabilities-fixed/

🎁 Source Code Disclosure in IIS 10.0! Almost.

There is a method to reveal the source code of some .NET apps. Here's how it works.

👉 https://swarm.ptsecurity.com/source-code-disclosure-in-asp-net-apps/

📱 New article by our researcher Andrey Pesnyak: "Android Jetpack Navigation: Deep Links Handling Exploitation"

Read about a flaw that allows an attacker to launch any fragments in a navigation graph associated with an exported activity.

https://swarm.ptsecurity.com/android-jetpack-navigation-deep-links-handling-exploitation/

🚀 We're excited to unveil a new tool developed by our researcher @kiber_io: APKd. Now, you can effortlessly download APKs from AppGallery, APKPure, and RuStore directly from the terminal!

Check it out here: https://github.com/kiber-io/apkd

🏭 We've tested the new RCE in Microsoft Outlook (CVE-2024-21378) in a production environment and confirm it works well!

A brief instruction for red teams:

1. Compile our enhanced DLL;
2. Use NetSPI's ruler and wait!

No back connect required!

🔥 📐📏