This advisory details a missing authentication and access control vulnerability allowing an unauthenticated attacker to gain unauthorised access to image data uploaded to CodiMD. Due to the insecure random filename generation functionality in the underlying Formidable library, filenames for uploaded images could be determined and the likelihood of this issue being exploited was increased.
Slack integrations such as webhook APIs are often used to alert on user actions to internal teams. A vulnerability was noted when user supplied data containing a large amount of white space was included in a request to the Slack webhook API. By including enough white space in this data, the messages would be split and truncated. As a result, the malicious payload after the whitespace would appear as a standalone message from the Slack bot. An attacker could exploit this to forge messages containing Slack message markup to perform social engineering and other attacks if an integration, such as a website or other software, included unvalidated user input in the message to the Slack webhook.
Configuring USBGuard without explicitly specifying vendor and product IDs allows an attacker to bypass some USB authorisation policies on Linux. A device may claim to belong to one USB class (e.g. say it’s a keyboard), but actually act as a network adapter, mass storage or other more exotic device. The Gnome desktop’s USB protection policies are vulnerable by default.
I recently came across some interesting behavior with .NET’s Path.Combine in a web application’s file upload functionality. Despite solid efforts by the development team to prevent hacker path traversal shenanigans (by blocking the usual dangerous characters), the application was still vulnerable due to the way Path.Combine treats certain input parameters and NTFS filesystem internals.
You’ve received a penetration test or security review report. The summaries are read, the report read-out meeting has happened, and now the hard part begins! This article discusses what to do after you receive your report. We’ll talk about the process from reproducing findings and implementing fixes, through to engaging confirmation testing efficiently. Getting familiar with this process can have some sweet additional benefits, like implicit security upskilling!
Intercepting proxies are something web application penetration testers, performance engineers and developers are likely fairly familiar with. Ever notice how a bunch of that functionality already exists in the browser’s DevTools, though? This article is going to show you how to implement an intercepting proxy by connecting to the browser over CDP (Chrome DevTools Protocol), eliminating the need for HTTP CONNECT, CA certificates, and TLS interception altogether.