The complete GraphQL Security Guide: Fixing the 13 most common GraphQL Vulnerabilities to make your API production ready
👤 by @jensneuse_de
The complete GraphQL security guide. 'Nuff said.
📝 Contents:
• The 13 most common GraphQL Vulnerabilities
• Solving the 13 most common GraphQL Vulnerabilities for private APIs
• Solving the 13 most common GraphQL Vulnerabilities for public APIs
https://wundergraph.com/blog/the_complete_graphql_security_guide_fixing_the_13_most_common_graphql_vulnerabilities_to_make_your_api_production_ready
👤 by @jensneuse_de
The complete GraphQL security guide. 'Nuff said.
📝 Contents:
• The 13 most common GraphQL Vulnerabilities
• Solving the 13 most common GraphQL Vulnerabilities for private APIs
• Solving the 13 most common GraphQL Vulnerabilities for public APIs
https://wundergraph.com/blog/the_complete_graphql_security_guide_fixing_the_13_most_common_graphql_vulnerabilities_to_make_your_api_production_ready
WunderGraph
The complete GraphQL Security Guide: Fixing the 13 most common GraphQL Vulnerabilities to make your API production ready
A description of the 13 most common GraphQL vulnerabilities and how to mitigate them.
SAP fixed Post-Auth RCE (CVE-2021-38163) in SAP NetWeaver found by our researcher Mikhail Klyuchnikov.
CVSS 9.9 🔥
No credits from SAP again.
Advisory: https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405
CVSS 9.9 🔥
No credits from SAP again.
Advisory: https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=585106405
RCE in Citrix ShareFile Storage Zones Controller (CVE-2021-22941) – A Walk-Through
👤 by Markus Wulftange
The vulnerability is triggerable when processing user upload requests, which can lead to Unauthorized RCE.
📝 Contents:
• Background
• The Travelogue
• Finding A Path From Sink To Source
• Are We Still on Track?
• What's in the backpack?
• Running With Razor
• Timeline and fix
https://codewhitesec.blogspot.com/2021/09/citrix-sharefile-rce-cve-2021-22941.html
👤 by Markus Wulftange
The vulnerability is triggerable when processing user upload requests, which can lead to Unauthorized RCE.
📝 Contents:
• Background
• The Travelogue
• Finding A Path From Sink To Source
• Are We Still on Track?
• What's in the backpack?
• Running With Razor
• Timeline and fix
https://codewhitesec.blogspot.com/2021/09/citrix-sharefile-rce-cve-2021-22941.html
Blogspot
CODE WHITE | Blog: RCE in Citrix ShareFile Storage Zones Controller (CVE-2021-22941) – A Walk-Through
Citrix ShareFile Storage Zones Controller uses a fork of the third party library NeatUpload. Versions before 5.11.20 are affected by a rela...
We are thrilled to announce the following presentations at @hardwear_io, @blackhatevents, #POC2021 and @hackinparis
Autodiscovering the Great Leak
👤 by Amit Serper
The design flaw within the Autodiscover protocol that makes it possible for an attacker who controls top-level Autodiscover domains (or has the ability to conduct a DNS-poisoning attack using these domains), to get valid domain credentials from leaky Autodiscover requests.
📝 Contents:
• Executive summary
• Introduction
• What is Autodiscover?
• Abusing the Leak
• The ol’ switcheroo
• Mitigation
• Conclusion
https://www.guardicore.com/labs/autodiscovering-the-great-leak/
👤 by Amit Serper
The design flaw within the Autodiscover protocol that makes it possible for an attacker who controls top-level Autodiscover domains (or has the ability to conduct a DNS-poisoning attack using these domains), to get valid domain credentials from leaky Autodiscover requests.
📝 Contents:
• Executive summary
• Introduction
• What is Autodiscover?
• Abusing the Leak
• The ol’ switcheroo
• Mitigation
• Conclusion
https://www.guardicore.com/labs/autodiscovering-the-great-leak/
Akamai
Akamai Blog | Autodiscovering the Great Leak
See the most recent research from Amit Serper on a vulnerability in Autodiscover from Microsoft Outlook that affects credential leaks.
"A tale of making internet pollution free" - Exploiting Client-Side Prototype Pollution in the wild
👤 by Mohan Sri Rama Krishna P, Sergey Bobrov, Terjanq, Beomjin Lee, Masato Kinugawa, Nikita Stupin, Rahul Maini, Harsh Jaiswal, Mikhail Egorov, Melar Dev, Michał Bentkowski, Filedescriptor, Olivier, William Bowling, Ian Bouchard
In JavaScript, an object inherits methods and properties from its prototype. Prototype Pollution it’s the situation when extra properties are added to a prototype of base
objects. Based on the application logic, prototype pollution leads to other vulnerabilities from RCE to SQL. This technical write-up touch the tools researchers are created, challenges they faced, and case studies during the whole process.
📝 Contents:
• Introduction
• Methodology
• Detection
• Case 1
• Selenium Bot
• Browser Extension
• Case 2
• Identifying the vulnerable library
• Blocking the JS resource request in Firefox
• Debugger Breakpoint on setter
• Finding Script Gadgets
• What is a script gadget?
• Keyword search and Source Code Review
• Filedescriptor’s untrusted-types extension
• Report
• Store vulnerable libraries and gadgets in database
• Case Studies
• Case Study 1: CodeQL for fun and profit
• Case Study 2: Prototype Pollution on Jira Service Management 4.16.0, <4.18.0(fix bypass)
• Case Study 3: XSS on apple.com found using chrome extension by Rahul and Harsh
• Case Study 4: HubSpot Analytics
• Case Study 5: Segment Analytics Pollution by Masato Kinugawa
• Mitigations
https://blog.s1r1us.ninja/research/PP
👤 by Mohan Sri Rama Krishna P, Sergey Bobrov, Terjanq, Beomjin Lee, Masato Kinugawa, Nikita Stupin, Rahul Maini, Harsh Jaiswal, Mikhail Egorov, Melar Dev, Michał Bentkowski, Filedescriptor, Olivier, William Bowling, Ian Bouchard
In JavaScript, an object inherits methods and properties from its prototype. Prototype Pollution it’s the situation when extra properties are added to a prototype of base
objects. Based on the application logic, prototype pollution leads to other vulnerabilities from RCE to SQL. This technical write-up touch the tools researchers are created, challenges they faced, and case studies during the whole process.
📝 Contents:
• Introduction
• Methodology
• Detection
• Case 1
• Selenium Bot
• Browser Extension
• Case 2
• Identifying the vulnerable library
• Blocking the JS resource request in Firefox
• Debugger Breakpoint on setter
• Finding Script Gadgets
• What is a script gadget?
• Keyword search and Source Code Review
• Filedescriptor’s untrusted-types extension
• Report
• Store vulnerable libraries and gadgets in database
• Case Studies
• Case Study 1: CodeQL for fun and profit
• Case Study 2: Prototype Pollution on Jira Service Management 4.16.0, <4.18.0(fix bypass)
• Case Study 3: XSS on apple.com found using chrome extension by Rahul and Harsh
• Case Study 4: HubSpot Analytics
• Case Study 5: Segment Analytics Pollution by Masato Kinugawa
• Mitigations
https://blog.s1r1us.ninja/research/PP
blog.s1r1us.ninja
s1r1us - Prototype Pollution
Introduction
New article: "Cisco Hyperflex: How We Got RCE Through Login Form and Other Findings"
Read more about critical vulnerabilities (CVSS 9.8, 7.3 and 5.3) found by our researchers
Nikita Abramov & Mikhail Klyuchnikov:
https://swarm.ptsecurity.com/cisco-hyperflex-how-we-got-rce-through-login-form-and-other-findings/
Read more about critical vulnerabilities (CVSS 9.8, 7.3 and 5.3) found by our researchers
Nikita Abramov & Mikhail Klyuchnikov:
https://swarm.ptsecurity.com/cisco-hyperflex-how-we-got-rce-through-login-form-and-other-findings/
Chasing a Dream :: Pre-authenticated Remote Code Execution in Dedecms
👤 by Steven Seeley
Technical review of Chinese CMS “Dedecms” including its attack surface and how it differs from other applications. In the end, the author ends up with a pre-authenticated remote code execution vulnerability impacting the v5.8.1 pre-release.
📝 Contents:
• Threat Modeling
• Defense in Depth
• Finding a pre-authenticated endpoint
• ShowMsg Remote Code Execution Vulnerability
• Summary
• Vulnerability Analysis
• Proof of Concept
• Reporting
• Conclusion
• References
https://srcincite.io/blog/2021/09/30/chasing-a-dream-pwning-the-biggest-cms-in-china.html
👤 by Steven Seeley
Technical review of Chinese CMS “Dedecms” including its attack surface and how it differs from other applications. In the end, the author ends up with a pre-authenticated remote code execution vulnerability impacting the v5.8.1 pre-release.
📝 Contents:
• Threat Modeling
• Defense in Depth
• Finding a pre-authenticated endpoint
• ShowMsg Remote Code Execution Vulnerability
• Summary
• Vulnerability Analysis
• Proof of Concept
• Reporting
• Conclusion
• References
https://srcincite.io/blog/2021/09/30/chasing-a-dream-pwning-the-biggest-cms-in-china.html
We have reproduced the fresh CVE-2021-41773 Path Traversal vulnerability in Apache 2.4.49.
If files outside of the document root are not protected by "require all denied" these requests can succeed.
Patch ASAP!
https://httpd.apache.org/security/vulnerabilities_24.html
If files outside of the document root are not protected by "require all denied" these requests can succeed.
Patch ASAP!
https://httpd.apache.org/security/vulnerabilities_24.html
CVE-2021-26420: Remote Code Execution in Sharepoint via workflow compilation
👤 by The ZDI Research Team
In June of 2021, Microsoft released a patch to correct CVE-2021-26420 – a remote code execution bug in the supported versions of Microsoft SharePoint Server. This bug was reported to the ZDI program by an anonymous researcher and is also known as ZDI-21-755. This blog takes a deeper look at the root cause of this vulnerability.
This vulnerability could be used by an authenticated user to execute arbitrary .NET code on the server in the context and permissions of the service account of a SharePoint web application. For a successful attack, the attacker should have “Manage Lists” permissions on any SharePoint site. By default, any authenticated user can create their own site where they have the necessary permissions.
📝 Contents:
• The Vulnerability
• Proof of Concept
• Achieving Remote Code Execution
• Conclusion
https://www.zerodayinitiative.com/blog/2021/10/5/cve-2021-26420-remote-code-execution-in-sharepoint-via-workflow-compilation
👤 by The ZDI Research Team
In June of 2021, Microsoft released a patch to correct CVE-2021-26420 – a remote code execution bug in the supported versions of Microsoft SharePoint Server. This bug was reported to the ZDI program by an anonymous researcher and is also known as ZDI-21-755. This blog takes a deeper look at the root cause of this vulnerability.
This vulnerability could be used by an authenticated user to execute arbitrary .NET code on the server in the context and permissions of the service account of a SharePoint web application. For a successful attack, the attacker should have “Manage Lists” permissions on any SharePoint site. By default, any authenticated user can create their own site where they have the necessary permissions.
📝 Contents:
• The Vulnerability
• Proof of Concept
• Achieving Remote Code Execution
• Conclusion
https://www.zerodayinitiative.com/blog/2021/10/5/cve-2021-26420-remote-code-execution-in-sharepoint-via-workflow-compilation
Zero Day Initiative
Zero Day Initiative — CVE-2021-26420: Remote Code Execution in SharePoint via Workflow Compilation
In June of 2021, Microsoft released a patch to correct CVE-20 21-264 20 – a remote code execution bug in the supported versions of Microsoft SharePoint Server. This bug was reported to the ZDI program by an anonymous researcher and is also known as ZDI…
We are pleased to present the utility developed by our researcher Philip Nikiforov for Flutter apps traffic monitoring.
Just make app trust installed certificates by repacking it with reFlutter and hunt bugs using Burp Suite. No root, no VPN, no more hassle!
https://github.com/ptswarm/reFlutter
Just make app trust installed certificates by repacking it with reFlutter and hunt bugs using Burp Suite. No root, no VPN, no more hassle!
https://github.com/ptswarm/reFlutter
Building a POC for CVE-2021-40438
👤 by Firzen
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. The author of the article found a way to exploit it
📝 Contents:
• The Patch
• How to exploit?
• How uds_path is being set?
• Success
• Conclusion and Remarks
https://firzen.de/building-a-poc-for-cve-2021-40438
👤 by Firzen
A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. The author of the article found a way to exploit it
📝 Contents:
• The Patch
• How to exploit?
• How uds_path is being set?
• Success
• Conclusion and Remarks
https://firzen.de/building-a-poc-for-cve-2021-40438
New article: "WinRAR’s vulnerable trialware: when free software isn’t free" by our researcher Igor Sak-Sakovskiy.
In this article, we show how vulnerabilities in trialware could beсome a gate for hackers.
https://swarm.ptsecurity.com/winrars-vulnerable-trialware-when-free-software-isnt-free/
In this article, we show how vulnerabilities in trialware could beсome a gate for hackers.
https://swarm.ptsecurity.com/winrars-vulnerable-trialware-when-free-software-isnt-free/
PHP-FPM Local Root Vulnerability
👤 by Charles Fol
PHP-FPM (FastCGI Process Manager) is the official PHP FastCGI server. It is used in conjunction with an HTTP server such as Apache or NGINX to handle the processing of PHP files. It generally listens for connections over either a UNIX socket or on TCP port 9000. When the HTTP server needs to run a PHP file, it will forward parameters, such as the file path, PHP variables, and configuration to PHP-FPM, which will send back a response.
A low-privilege process can read and write an array of pointers used by the main process, running as root, through shared memory. An attacker can leverage this problem to change a 32-bit integer from zero to one in the main process's memory, or clear a memory region. By leveraging the primitive multiple times, it is possible to reach another bug, make the main process execute code, and thus escalate privileges.
Due to the growing adoption of NGINX instead of Apache, a good look at PHP-FPM was in order. An oversight in the design of the shared memory region lead to half-decent exploitation primitives, which in turn lead to a root privilege escalation.
📝 Contents:
• Introduction
• Overview of the bug
• Overview of PHP-FPM
• Main process and workers
• Scoreboards
• IPC through SHM
• Proecss scoreboard management and the bad primitive
• An example
• Exploitation
• Tailoring the primitive
• Reaching the heap: setting catch_workers_output
• Good enough ?
• All your bases
• Persistent worker control
• Capping the number of workers
• Closed FD
• Error-free PHP
• Problem-free exploitation tactics
• Managing streams: zlog_stream
• Unreachable heap overflow
• Faking the streams, getting root
• Heap overflow
• Arbitrary write
• Demo
• Vulnerable versions
• Conclusion and Remarks
https://ambionics.io/blog/php-fpm-local-root
👤 by Charles Fol
PHP-FPM (FastCGI Process Manager) is the official PHP FastCGI server. It is used in conjunction with an HTTP server such as Apache or NGINX to handle the processing of PHP files. It generally listens for connections over either a UNIX socket or on TCP port 9000. When the HTTP server needs to run a PHP file, it will forward parameters, such as the file path, PHP variables, and configuration to PHP-FPM, which will send back a response.
A low-privilege process can read and write an array of pointers used by the main process, running as root, through shared memory. An attacker can leverage this problem to change a 32-bit integer from zero to one in the main process's memory, or clear a memory region. By leveraging the primitive multiple times, it is possible to reach another bug, make the main process execute code, and thus escalate privileges.
Due to the growing adoption of NGINX instead of Apache, a good look at PHP-FPM was in order. An oversight in the design of the shared memory region lead to half-decent exploitation primitives, which in turn lead to a root privilege escalation.
📝 Contents:
• Introduction
• Overview of the bug
• Overview of PHP-FPM
• Main process and workers
• Scoreboards
• IPC through SHM
• Proecss scoreboard management and the bad primitive
• An example
• Exploitation
• Tailoring the primitive
• Reaching the heap: setting catch_workers_output
• Good enough ?
• All your bases
• Persistent worker control
• Capping the number of workers
• Closed FD
• Error-free PHP
• Problem-free exploitation tactics
• Managing streams: zlog_stream
• Unreachable heap overflow
• Faking the streams, getting root
• Heap overflow
• Arbitrary write
• Demo
• Vulnerable versions
• Conclusion and Remarks
https://ambionics.io/blog/php-fpm-local-root
Ambionics
PHP-FPM local root vulnerability (CVE-2021-21703)
This article reveals a privilege escalation vulnerability affecting PHP-FPM.
Discourse SNS webhook RCE
👤 by joernchen
Discourse is the open source discussion platform built for the next decade of the Internet. It can be used as a: mailing list, discussion forum, long-form chat room etc
A validation bug in the upstream aws-sdk-sns gem can lead to RCE in Discourse via a maliciously crafted request.
https://0day.click/recipe/discourse-sns-rce/
👤 by joernchen
Discourse is the open source discussion platform built for the next decade of the Internet. It can be used as a: mailing list, discussion forum, long-form chat room etc
A validation bug in the upstream aws-sdk-sns gem can lead to RCE in Discourse via a maliciously crafted request.
https://0day.click/recipe/discourse-sns-rce/
0day.click
Discourse SNS webhook RCE
I was staring at this part of the code for way too long already:
module Jobs class ConfirmSnsSubscription < ::Jobs::Base sidekiq_options retry: false def execute(args) return unless raw = args[:raw].presence return unless json = args[:json].presence return…
module Jobs class ConfirmSnsSubscription < ::Jobs::Base sidekiq_options retry: false def execute(args) return unless raw = args[:raw].presence return unless json = args[:json].presence return…
Sitecore Experience Platform Pre-Auth RCE
👤 by Shubham Shah
In this blog post, research team detail a pre-authentication RCE vulnerability that affects Sitecore XP versions from 7.5 Initial Release to Sitecore XP 8.2 Update-7.
Sitecore’s Experience Platform (XP) is an enterprise content management system (CMS). This CMS is used heavily by enterprises, including many of the companies within the fortune 500.
The vulnerability is applicable to all Sitecore systems running affected versions, including single-instance and multi-instance environments, Managed Cloud environments, and all Sitecore server roles (Content Delivery, Content Editing, Reporting, Processing, etc.), which are exposed to the Internet.
📝 Contents:
• Intro
• What is Sitecore Experience Platform?
• Mapping out the attack surface
• Discovering the RCE
• Remediation Advice
• Conclusion
https://blog.assetnote.io/2021/11/02/sitecore-rce/
👤 by Shubham Shah
In this blog post, research team detail a pre-authentication RCE vulnerability that affects Sitecore XP versions from 7.5 Initial Release to Sitecore XP 8.2 Update-7.
Sitecore’s Experience Platform (XP) is an enterprise content management system (CMS). This CMS is used heavily by enterprises, including many of the companies within the fortune 500.
The vulnerability is applicable to all Sitecore systems running affected versions, including single-instance and multi-instance environments, Managed Cloud environments, and all Sitecore server roles (Content Delivery, Content Editing, Reporting, Processing, etc.), which are exposed to the Internet.
📝 Contents:
• Intro
• What is Sitecore Experience Platform?
• Mapping out the attack surface
• Discovering the RCE
• Remediation Advice
• Conclusion
https://blog.assetnote.io/2021/11/02/sitecore-rce/
How to exploit CVE-2021-40539 on ManageEngine ADSelfService Plus
👤 by Antoine Cervoise, Wilfried Bécard
ADSS offers multiple functionalities such as managing password policies for administrators or self password reset/account unlock for Active Directory users.
In this article research team explore the details of several vulnerabilities that allow an unauthenticated attacker to execute arbitrary code on the server.
📝 Contents:
• First steps
• Authentication Bypass
• Arbitrary file upload through the API
• Arguments injection
• Chaining everything together to get code execution
• Conclusion
https://www.synacktiv.com/publications/how-to-exploit-cve-2021-40539-on-manageengine-adselfservice-plus.html
👤 by Antoine Cervoise, Wilfried Bécard
ADSS offers multiple functionalities such as managing password policies for administrators or self password reset/account unlock for Active Directory users.
In this article research team explore the details of several vulnerabilities that allow an unauthenticated attacker to execute arbitrary code on the server.
📝 Contents:
• First steps
• Authentication Bypass
• Arbitrary file upload through the API
• Arguments injection
• Chaining everything together to get code execution
• Conclusion
https://www.synacktiv.com/publications/how-to-exploit-cve-2021-40539-on-manageengine-adselfservice-plus.html
Synacktiv
How to exploit CVE-2021-40539 on ManageEngine ADSelfService Plus
Zoom fixed two post-auth RCE (CVE-2021-34416, CVE-2021-34414) and remote system crash (CVE-2021-34415) in Zoom on-premise Meeting Connector found by our researchers Nikita Abramov and Egor Dimitrenko.
Advisory: https://explore.zoom.us/en/trust/security/security-bulletin/
Advisory: https://explore.zoom.us/en/trust/security/security-bulletin/
Cisco fixed an Unauth DoS (CVE-2021-34704) in Cisco ASA and Cisco FTD found by our researcher Nikita Abramov.
A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
Shodan: 242,070 results 🔥
Advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asafdt-webvpn-dos-KSqJAKPA
A successful exploit could allow the attacker to cause the device to reload, resulting in a DoS condition.
Shodan: 242,070 results 🔥
Advisory: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asafdt-webvpn-dos-KSqJAKPA