JLLeitschuh

import tutorial

from Person t
where t.getHeight() > 150 and
	t.getHairColor() != "blond" and
	exists (string c | t.getHairColor() = c) and
	t.getAge() >= 30 and
	t.getLocation() = "east" and
	(t.getHairColor() = "black" or t.getHairColor() = "brown") and
	not (t.getHeight() > 180 and t.getHeight() < 190) and

JLLeitschuh

GCHQ Stroom is vulnerable to Cross-Site Scripting due to the ability to load the Stroom dashboard on another site and insufficient protection against window event origins.

Versions

• Affected versions: < 5.5.12 & < 6.0.25
• Patched versions: 5.5.12 & 6.0.25

POC

Launch Stroom and assign it a hostname like stroom.my-company.com, then log in.

JLLeitschuh

Safer-Eval Sandbox Escape POC

safer-eval is a node JS library that supposedly provides a 'safe' way to 'eval' untrusted javascript.

As the maintainer warns in the README:

Warning: The saferEval function may be harmful - so you are warned!

However, it is still used by various libraries to parse/execute untrusted code in such a way that there is an implied

JLLeitschuh

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

The Ktor Coroutine based I/O Server implementation io.ktor.client.engine.cio.CIO is vulnerable to HTTP Response Splitting.

Fixed Version

This vulnerability is fixed in Ktor version 1.2.6.

POC

JLLeitschuh

CVE Numbers for Discovered Vulnerabilities

This is just a simple location I'm using to keep a running list of vulnerabilities I've discovered or have participated in the discovery of.

---

I decided to move this to Google Sheets. Too complicated to keep the formatting straight here: https://docs.google.com/spreadsheets/d/1Qj0gpocVWLYarIoYZmT-vCwWmZC6kXZ3DdNV_lPmXcc/edit?usp=sharing

JLLeitschuh

GitHub Security Advisories

If this is your first time using GitHub Security Advisories, please allow me to guide you through how they work.

Advisories are Private

As of September 17th, 2019, when advisories are published, the entire discussion within the advisory will not be made public. Any information you want to provide to the public should be included in the advisory body.

Updating an Advisory

JLLeitschuh

Artifact Server Annoucements

This document captures the links to all of the different artifact server hosts that have announced they will be formally depricating downloading dependencies over HTTP and will only be supporting HTTPS starting in January 2020.

Want to take over the Java ecosystem? All you need is a MITM!

Maven Sonatype

JLLeitschuh

CVE-2019-15848: TeamCity XSS to Remote Code Execution

This POC demonstrates taking advantage of a XSS vulnerability in TeamCity allowing an attacker to achieve Remote Code Execution on a build agent if the victim has the ability to add steps to a CI job.

POC

The POC can be simplified to the following URL:

https://[domain.com]/project.html?projectId=[target_project_id]&tab=problems%27%7D)%3B%7D)()%3B[JS_PAYLOAD]

JLLeitschuh

# To prevent the vulnerable server from running on your machine
# (this does not impact Zoom functionality), run these two lines in your Terminal.

pkill "ZoomOpener"; rm -rf ~/.zoomus; touch ~/.zoomus && chmod 000 ~/.zoomus;

pkill "RingCentralOpener";  rm -rf ~/.ringcentralopener; touch ~/.ringcentralopener && chmod 000 ~/.ringcentralopener;

# (You may need to run these lines for each user on your machine.)

JLLeitschuh

# For just your local account
defaults write ~/Library/Preferences/us.zoom.config.plist ZDisableVideo 1
# For all users on the machine
sudo defaults write /Library/Preferences/us.zoom.config.plist ZDisableVideo 1