{"version": "https://jsonfeed.org/version/1", "title": "/dev/posts/ - Tag index - security", "home_page_url": "https://www.gabriel.urdhr.fr", "feed_url": "/tags/security/feed.json", "items": [{"id": "http://www.gabriel.urdhr.fr/2026/06/27/ecdsa-jwt-malleability/", "title": "Malleability of ECDSA (and DSA) signatures, JWTs, etc.", "url": "https://www.gabriel.urdhr.fr/2026/06/27/ecdsa-jwt-malleability/", "date_published": "2026-06-27T00:00:00+02:00", "date_modified": "2026-06-27T00:00:00+02:00", "tags": ["computer", "security", "cryptography", "elliptic-curve", "jwt", "ecdsa"], "content_html": "<p>This blog posts explains that ECDSA and DSA signatures are malleable,\nthat JWTs can be malleable as well\nand how this can be used to bypass some broken implementations\nof JWT deny lists\n(for revocation of JWTs or anti-replay protection).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2026/06/03/websub-reflected-xss/", "title": "Risk of reflected cross site scripting and Content-Security-Policy bypass in the WebSub intent verification", "url": "https://www.gabriel.urdhr.fr/2026/06/03/websub-reflected-xss/", "date_published": "2026-06-03T00:00:00+02:00", "date_modified": "2026-06-20T13:23:01+02:00", "tags": ["computer", "web", "websub", "security", "xss"], "content_html": "<p>I was reading the <a href=\"https://www.w3.org/TR/2018/REC-websub-20180123/\">WebSub</a> specification\n(formerly <a href=\"https://pubsubhubbub.github.io/PubSubHubbub/pubsubhubbub-core-0.4.html\">PubSubHubbub</a>)\nwhen I found that there was a <a href=\"https://github.com/w3c/websub/security/advisories/GHSA-f4hw-w632-m6wh\">risk of reflected browser-side code injection</a>\n(reflected <a href=\"https://owasp.org/www-community/attacks/xss/\">cross site scripting</a>, reflected XSS)\nin the WebSub intent verification exchange.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2026/05/28/security-references/", "title": "Computer security guidelines and references", "url": "https://www.gabriel.urdhr.fr/2026/05/28/security-references/", "date_published": "2026-05-28T23:10:15+02:00", "date_modified": "2026-07-01T09:03:00+02:00", "tags": ["computer", "security", "references"], "content_html": "<p>A list of computer security guidelines and references.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2026/05/28/nginx-host-ambiguity/", "title": "Authority Ambiguity Vulnerabilities in NGINX and Debian\u2019s proxy_params", "url": "https://www.gabriel.urdhr.fr/2026/05/28/nginx-host-ambiguity/", "date_published": "2026-05-28T23:07:55+02:00", "date_modified": "2026-05-28T23:07:55+02:00", "tags": ["computer", "web", "security", "nginx", "http"], "content_html": "<p>Two related authority-ambiguity vulnerabilities in NGINX\nand Debian's <code>proxy_params</code> configuration snippet.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2026/05/19/cryptography-formats/", "title": "Cryptography formats", "url": "https://www.gabriel.urdhr.fr/2026/05/19/cryptography-formats/", "date_published": "2026-05-19T00:00:00+02:00", "date_modified": "2026-05-19T00:00:00+02:00", "tags": ["computer", "security", "cryptography", "ssh", "jose", "jwt", "cose"], "content_html": "<p>If you are trying to understand the difference between the different\ncryptography-related formats\n(PKS#12, PKCS#8, PEM, X.509 certificate, DER, JWK, <code>BEGIN ENCRYPTED PRIVATE KEY</code>??? \ud83e\udd2f),\nyou will hopefully find some useful information here\n(and a lot more your did not wanted to know about).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2025/08/22/concealing-xss-payload/", "title": "Concealing XSS payloads", "url": "https://www.gabriel.urdhr.fr/2025/08/22/concealing-xss-payload/", "date_published": "2025-08-22T00:09:04+02:00", "date_modified": "2025-08-22T00:09:04+02:00", "tags": ["computer", "security", "xss", "waf"], "content_html": "<p>PortSwigger <a href=\"https://portswigger.net/research/concealing-payloads-in-url-credentials\">\u201cConcealing payloads in URL credentials\u201d</a>\ntalks about concealing XSS payloads in URL credentials.\nThe nice thing is that this makes the payload invisible to WAFs and other server-side XSS filters.\nYou can actually conceal the payloads in other places</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2025/08/20/unicode-tag-smuggling/", "title": "Testing Unicode Tag Smuggling in chatbots", "url": "https://www.gabriel.urdhr.fr/2025/08/20/unicode-tag-smuggling/", "date_published": "2025-08-20T00:00:00+02:00", "date_modified": "2026-01-16T01:06:36+01:00", "tags": ["computer", "security", "language-model", "LLM"], "content_html": "<p>Testing <a href=\"https://embracethered.com/blog/posts/2024/hiding-and-finding-text-with-unicode-tags\">ASCII smuggling</a>\nusing <a href=\"https://en.wikipedia.org/wiki/Tags_(Unicode_block)\">Unicode Tags</a>\non LLMs/chatbots.\nNothing new here.\nJust a short summary.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2025/07/08/keycloak-uma-vulnerabilities/", "title": "Keycloak UMA vulnerabilities", "url": "https://www.gabriel.urdhr.fr/2025/07/08/keycloak-uma-vulnerabilities/", "date_published": "2025-07-08T00:00:00+02:00", "date_modified": "2025-07-08T00:00:00+02:00", "tags": ["computer", "protocol", "web", "security", "oauth", "keycloak", "security", "uma", "openid-connect"], "content_html": "<p>Keycloak's UMA implementation seems tricky to me.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2025/03/18/uma-malicious-as/", "title": "Malicious authorization server attack in UMA\u00a02.0", "url": "https://www.gabriel.urdhr.fr/2025/03/18/uma-malicious-as/", "date_published": "2025-03-18T21:23:51+01:00", "date_modified": "2025-03-18T21:23:51+01:00", "tags": ["computer", "protocol", "web", "security", "oauth", "uma"], "content_html": "<p>In a <a href=\"https://www.gabriel.urdhr.fr/2025/03/18/uma-pass-the-permission-token/\">previous post</a>,\nI described a pass-the-permission-ticket vulnerability in UMA\u00a02.0\nin which a malicious UMA resource server\ncould kindly ask a UMA client\nto give it access tokens actually intended for another UMA resource server.\nIn this post,\nI am describing a similar attack when the authorization server is malicious.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2025/03/18/uma-pass-the-permission-token/", "title": "Pass-the-permission-ticket vulnerability in UMA\u00a02.0", "url": "https://www.gabriel.urdhr.fr/2025/03/18/uma-pass-the-permission-token/", "date_published": "2025-03-18T21:23:50+01:00", "date_modified": "2025-03-18T21:23:50+01:00", "tags": ["computer", "protocol", "web", "security", "oauth", "uma"], "content_html": "<p>In the <a href=\"https://docs.kantarainitiative.org/uma/wg/rec-oauth-uma-grant-2.0.html\">User-Managed Access</a> (UMA) 2.0 protocol,\na malicious resource server (or a malicious server acting as a resource server)\ncan obtain a requesting party (access) token (RPT)\nintended for another UMA resource server\nfrom a UMA client\nby passing a permission ticket obtained from the target resource server to the UMA client.\nThis can compromise the privacy (confidentiality)\nand integrity of UMA protected resources.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2025/01/27/exposing-services-podman/", "title": "Exposing services in/out Podman containers", "url": "https://www.gabriel.urdhr.fr/2025/01/27/exposing-services-podman/", "date_published": "2025-01-27T00:00:00+01:00", "date_modified": "2025-01-27T00:00:00+01:00", "tags": ["computer", "linux", "system", "podman", "container", "security"], "content_html": "<p>Some more tips for interacting\nwith the <a href=\"https://man7.org/linux/man-pages/man7/namespaces.7.html\">namespaces</a>\nof <a href=\"https://podman.io/\">Podman</a> containers.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2024/12/26/github-copilot-prompt/", "title": "GitHub Copilot instructions", "url": "https://www.gabriel.urdhr.fr/2024/12/26/github-copilot-prompt/", "date_published": "2024-12-26T00:00:00+01:00", "date_modified": "2024-12-26T00:00:00+01:00", "tags": ["computer", "machine-learning", "deep-learning", "language-model", "security", "LLM"], "content_html": "<p>Extracting the system prompt from GitHub CoPilot.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2024/11/20/xss-bypass/", "title": "Bypassing XSS filters", "url": "https://www.gabriel.urdhr.fr/2024/11/20/xss-bypass/", "date_published": "2024-11-20T00:00:00+01:00", "date_modified": "2024-11-20T00:00:00+01:00", "tags": ["computer", "security", "xss", "waf"], "content_html": "<p>In this post, I am describing some payloads which\nI used to bypass two distinct XSS filter implementations\n(such as Web Application Firewalls (WAF))\nas well as the approach to design them.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2024/09/08/on-ad-blockers/", "title": "The FBI recommends using ad blockers", "url": "https://www.gabriel.urdhr.fr/2024/09/08/on-ad-blockers/", "date_published": "2024-09-08T00:00:00+02:00", "date_modified": "2024-09-08T00:00:00+02:00", "tags": ["computer", "web", "security", "privacy"], "content_html": "<p>An interesting note from the FBI.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2024/06/17/uma2-diagrams/", "title": "UMA 2.0 diagrams", "url": "https://www.gabriel.urdhr.fr/2024/06/17/uma2-diagrams/", "date_published": "2024-06-17T00:00:00+02:00", "date_modified": "2024-06-17T00:00:00+02:00", "tags": ["computer", "protocol", "web", "security", "oauth", "uma"], "content_html": "<p>Some diagrams (mostly sequence diagrams) about UMA 2.0.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/09/23/code-execution-through-kitty-open/", "title": "Arbitrary code execution through kitty-open.desktop file association", "url": "https://www.gabriel.urdhr.fr/2023/09/23/code-execution-through-kitty-open/", "date_published": "2023-09-23T00:00:00+02:00", "date_modified": "2023-09-23T00:00:00+02:00", "tags": ["computer", "security", "terminal", "kitty"], "content_html": "<p>In Debian <code>kitty</code> package, the\n<code>kitty-open.desktop</code> file would associate <code>kitty +open</code> with several MIME types.\nThis could be used to arbitrary trigger code execution by serving a\nfile with such a MIME type.</p>\n<p>This has been introduced in kitty in <a href=\"https://github.com/kovidgoyal/kitty/commit/73a197fcd\">73a197fcd</a> (2022-02-06)\nreleased as part of v0.24.3.\nThis has been fixed in v0.26.5-5 of the Debian kitty package.\nFixed upstream in\n<a href=\"https://github.com/kovidgoyal/kitty/commit/537cabca7\">537cabca7</a>\nreleased in v0.29.0.\nOther distributions\nsuch as <a href=\"https://packages.ubuntu.com/lunar/kitty\">Ubuntu Lunar</a>\nare still impacted.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/06/08/emacsclient-mail-shell-elisp-injections/", "title": "Shell command and Emacs Lisp injection in emacsclient-mail.desktop", "url": "https://www.gabriel.urdhr.fr/2023/06/08/emacsclient-mail-shell-elisp-injections/", "date_published": "2023-06-08T23:43:56+02:00", "date_modified": "2023-06-08T23:43:56+02:00", "tags": ["computer", "security", "emacs", "shell", "unix", "freedesktop"], "content_html": "<p>Shell command injection and Emacs Lisp injection vulnerabilities\nin one of the Emacs Desktop Entry (emacsclient-mail.desktop)\nleading to arbitrary code execution\nthrough a crafted <code>mailto:</code> URI.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/06/08/arbitrary-file-write-in-stellarium-file-association/", "title": "Arbitrary file write in Stellarium file association", "url": "https://www.gabriel.urdhr.fr/2023/06/08/arbitrary-file-write-in-stellarium-file-association/", "date_published": "2023-06-08T23:20:04+02:00", "date_modified": "2023-06-08T23:20:04+02:00", "tags": ["computer", "security", "vulnerability"], "content_html": "<p>I found an arbitrary file write vulnerability (through path traversal)\nwhich would be exploited\nfor arbitrary code execution in <a href=\"https://stellarium.org/\">Stellarium</a> (desktop version).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/03/07/mime-type-spoofing/", "title": "MIME-type spoofing in Firefox/Thunderbird and file managers", "url": "https://www.gabriel.urdhr.fr/2023/03/07/mime-type-spoofing/", "date_published": "2023-03-07T00:00:00+01:00", "date_modified": "2023-03-07T00:00:00+01:00", "tags": ["computer", "web", "security", "vulnerability", "firefox", "freedesktop", "thunderbird"], "content_html": "<p>An interesting spoofing attack\nresulting from the interaction\nbetween Firefox (or Thunderbird)\nMIME types handling and file managers.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/02/28/rce-file-association-debian-mono/", "title": "Code execution through MIME-type association of Mono interpreter", "url": "https://www.gabriel.urdhr.fr/2023/02/28/rce-file-association-debian-mono/", "date_published": "2023-02-28T00:00:00+01:00", "date_modified": "2023-02-28T00:00:00+01:00", "tags": ["computer", "web", "security", "vulnerability", "debian", "freedesktop", "mono"], "content_html": "<p>A dangerous file type association in <a href=\"https://www.debian.org/\">Debian</a>\nwhich could be used to trigger arbitrary code execution.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/02/06/oauth2-diagrams/", "title": "OAuth 2.x and OpenID Connect sequence diagrams", "url": "https://www.gabriel.urdhr.fr/2023/02/06/oauth2-diagrams/", "date_published": "2023-02-06T00:00:00+01:00", "date_modified": "2026-07-10T08:15:00+02:00", "tags": ["computer", "protocol", "web", "security", "oauth", "openid-connect", "keycloak"], "content_html": "<p>Some sequence diagrams about OAuth 2.x and OpenID Connect.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/12/03/entering-podman-namespaces/", "title": "Entering in Podman containers", "url": "https://www.gabriel.urdhr.fr/2022/12/03/entering-podman-namespaces/", "date_published": "2022-12-03T00:00:00+01:00", "date_modified": "2022-12-03T00:00:00+01:00", "tags": ["computer", "linux", "system", "podman", "container", "security"], "content_html": "<p>Some commands for interacting with the <a href=\"https://man7.org/linux/man-pages/man7/namespaces.7.html\">namespaces</a>\nof <a href=\"https://podman.io/\">Podman</a> containers.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/06/07/impact-of-the-different-wifi-security-modes/", "title": "Impact of the different Wifi security modes", "url": "https://www.gabriel.urdhr.fr/2022/06/07/impact-of-the-different-wifi-security-modes/", "date_published": "2022-06-07T00:00:00+02:00", "date_modified": "2024-01-05T13:47:35+01:00", "tags": ["computer", "network", "wifi", "security"], "content_html": "<p>Comparing the different Wifi/WPA authentication and key distribution methods (PSK, EAP, SEA).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/05/05/browser-mediated-attacks-on-webdriver/", "title": "Browser-based attacks on WebDriver implementations", "url": "https://www.gabriel.urdhr.fr/2022/05/05/browser-mediated-attacks-on-webdriver/", "date_published": "2022-05-05T00:00:00+02:00", "date_modified": "2022-05-05T00:00:00+02:00", "tags": ["computer", "security", "web", "vulnerability", "webdriver", "firefox", "dns-rebinding", "csrf"], "content_html": "<p>Some context and analysis about attacks on\nin <a href=\"https://www.w3.org/TR/webdriver/\">WebDriver</a> implementations.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/03/24/zap-no-certificate-validation/", "title": "Lack of X.509 TLS certificate validation in OWASP ZAP", "url": "https://www.gabriel.urdhr.fr/2022/03/24/zap-no-certificate-validation/", "date_published": "2022-03-24T00:00:00+01:00", "date_modified": "2022-03-24T00:00:00+01:00", "tags": ["computer", "security", "zap", "tls", "vulnerability"], "content_html": "<p>Lack of X.509 TLS certificate validation in OWASP <a href=\"https://www.zaproxy.org/\">ZAP</a>\n(Zed Attack Proxy)\ncould be used for man-in-the-middle attacks.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/03/15/dns-rebinding-readymedia/", "title": "DNS rebinding on ReadyMedia/minidlna v1.3.0 and below", "url": "https://www.gabriel.urdhr.fr/2022/03/15/dns-rebinding-readymedia/", "date_published": "2022-03-15T00:00:00+01:00", "date_modified": "2022-03-15T00:00:00+01:00", "tags": ["computer", "security", "upnp", "dns-rebinding", "vulnerability"], "content_html": "<p>A DNS rebinding vulnerability I found\nin <a href=\"https://sourceforge.net/projects/minidlna/\">ReadyMedia</a> (formerly MiniDLNA)\nv1.3.0 and below.\nThis is <a href=\"https://nvd.nist.gov/vuln/detail/CVE-2022-26505\">CVE-2022-26505</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/", "title": "CSRF and DNS-rebinding to RCE in Selenium Server (Grid)", "url": "https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/", "date_published": "2022-02-07T22:15:00+01:00", "date_modified": "2022-02-07T22:15:00+01:00", "tags": ["computer", "security", "web", "vulnerability", "webdriver", "csrf", "dns-rebinding"], "content_html": "<p>Vulnerabilities in found on the <a href=\"https://www.w3.org/TR/webdriver2/\">WebDriver</a>\nendpoints of Selenium Server (Grid).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/02/07/geckodriver-dns-rebinding-rce/", "title": "DNS rebinding vulnerability to RCE in GeckoDriver", "url": "https://www.gabriel.urdhr.fr/2022/02/07/geckodriver-dns-rebinding-rce/", "date_published": "2022-02-07T22:10:00+01:00", "date_modified": "2022-02-07T22:10:00+01:00", "tags": ["computer", "security", "web", "vulnerability", "webdriver", "firefox", "dns-rebinding"], "content_html": "<p>A DNS rebinding vulnerability I found in\nGeckoDriver which could be used to execute arbitrary shell commands.\nThis is bug <a href=\"https://bugzilla.mozilla.org/show_bug.cgi?id=1652612\">#1652612</a>\nand <a href=\"https://nvd.nist.gov/vuln/detail/CVE-2021-4138\">CVE-2021-4138</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/08/16/chromedriver-cross-origin-request-forgery-rce/", "title": "Cross-origin/same-site request forgery to RCE in chromedriver", "url": "https://www.gabriel.urdhr.fr/2021/08/16/chromedriver-cross-origin-request-forgery-rce/", "date_published": "2021-08-16T23:22:56+02:00", "date_modified": "2022-02-13T23:19:32+01:00", "tags": ["computer", "security", "web", "vulnerability", "webdriver", "csrf"], "content_html": "<p>I found a cross-origin/same-site request forgery vulnerability\nin chromedriver.\nIt was <a href=\"https://bugs.chromium.org/p/chromium/issues/detail?id=1100097\">rejected</a> (won't fix) because it is only\npossible to trigger this from the cross-origin/same-site and not cross-site.\nIn practice, it means it is really only possible to trigger this from another\nlocalhost-bound web application.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/08/16/geckodriver-csrf-rce/", "title": "CSRF to RCE in GeckoDriver", "url": "https://www.gabriel.urdhr.fr/2021/08/16/geckodriver-csrf-rce/", "date_published": "2021-08-16T23:00:48+02:00", "date_modified": "2021-08-16T23:00:48+02:00", "tags": ["computer", "security", "web", "vulnerability", "webdriver", "firefox", "csrf"], "content_html": "<p>A Cross-Site Request Forgery (CSRF) vulnerability I found in\nGeckoDriver which could be used to execute arbitrary shell commands.\n<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-15660\">CVE-2020-15660</a>\nhas been assigned to this vulnerability.\nThis was fixed by <a href=\"https://github.com/mozilla/geckodriver/releases/tag/v0.27.0\">GeckoDriver v0.27.0</a>\nin 2020-07-27.\nThis is <a href=\"https://bugzilla.mozilla.org/show_bug.cgi?id=1648964\">bug #1648964</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/06/24/gupnp-dns-rebinding/", "title": "DNS rebinding vulnerability in GUPnP", "url": "https://www.gabriel.urdhr.fr/2021/06/24/gupnp-dns-rebinding/", "date_published": "2021-06-24T00:00:00+02:00", "date_modified": "2021-07-05T18:50:55+02:00", "tags": ["computer", "security", "upnp", "dns-rebinding", "vulnerability"], "content_html": "<p>GUPnP, a GNOME library for Universal Plug and Play (UPnP),\nwas vulnerable to <a href=\"https://www.gabriel.urdhr.fr/2021/06/02/dns-rebinding-explained/\">DNS rebinding</a> attacks.\nThis is <a href=\"https://nvd.nist.gov/vuln/detail/CVE-2021-33516\">CVE-2021-33516</a>\nand <a href=\"https://gitlab.gnome.org/GNOME/gupnp/-/issues/24\">GUPnP issue #24</a>.\nThis <a href=\"https://discourse.gnome.org/t/security-relevant-releases-for-gupnp-issue-cve-2021-33516/6536/3\">was fixed</a>\nin GUPnP 1.0.7 and GUPnP 1.2.5.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/06/12/pupnp-dns-rebinding/", "title": "DNS rebinding vulnerability in pupnp and npupnp", "url": "https://www.gabriel.urdhr.fr/2021/06/12/pupnp-dns-rebinding/", "date_published": "2021-06-12T00:00:00+02:00", "date_modified": "2021-06-12T00:00:00+02:00", "tags": ["computer", "security", "upnp", "dns-rebinding", "vulnerability"], "content_html": "<p>I found that <a href=\"https://github.com/pupnp/pupnp\">pupnp</a> was vulnerable to DNS rebinding attacks.\n<a href=\"https://framagit.org/medoc92/npupnp\">npupnp</a>, a fork a pupnp, was impacted as well.\nThis is demonstrated using Gerbera a UPnP MediaServer.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/06/02/dns-rebinding-explained/", "title": "DNS rebinding explained", "url": "https://www.gabriel.urdhr.fr/2021/06/02/dns-rebinding-explained/", "date_published": "2021-06-02T00:00:00+02:00", "date_modified": "2021-06-02T00:00:00+02:00", "tags": ["computer", "security", "dns-rebinding", "dns"], "content_html": "<p>A quick summary about how DNS rebinding attacks work.\nThe main motivation for this post is to have\na diagram to show when explaining DNS-rebinding attacks.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/04/05/firefox-doh-dns-rebinding-protection-bypass/", "title": "Firefox DoH DNS rebinding protection bypass using IPv4-mapped addresses", "url": "https://www.gabriel.urdhr.fr/2021/04/05/firefox-doh-dns-rebinding-protection-bypass/", "date_published": "2021-04-05T00:00:00+02:00", "date_modified": "2021-04-05T00:00:00+02:00", "tags": ["computer", "security", "vulnerability", "web", "dns-rebinding", "firefox"], "content_html": "<p>I found that\nthe filtering of private IPv4 addresses\nin the <a href=\"https://tools.ietf.org/html/rfc8484\">DNS-over-HTTPS</a> (DoH) implementation of Firefox could by bypassed.\nThis is <a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-26961\">CVE-2020-26961</a>\nand <a href=\"https://bugzilla.mozilla.org/show_bug.cgi?id=1672528\">Mozilla bug 1672528</a>.\nIt has been fixed in <a href=\"https://www.mozilla.org/en-US/security/advisories/mfsa2020-50/\">Firefox 83</a>,\n<a href=\"https://www.mozilla.org/en-US/security/advisories/mfsa2020-51/\">Firefox ESR 78.5</a>\nand <a href=\"https://www.mozilla.org/en-US/security/advisories/mfsa2020-52/\">Thunderbird 78.5</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/03/22/introduction-to-upnp/", "title": "Introduction to UPnP", "url": "https://www.gabriel.urdhr.fr/2021/03/22/introduction-to-upnp/", "date_published": "2021-03-22T23:24:42+01:00", "date_modified": "2021-03-22T23:24:42+01:00", "tags": ["computer", "network", "upnp", "security", "csrf", "dns-rebinding"], "content_html": "<p>This post gives simple explanations of how UPnP (Universal Plug-and-Play) works,\nespecially with the goal of testing the security devices\nsuch as <a href=\"https://www.gabriel.urdhr.fr/2020/09/23/dns-rebinding-freebox/\">routers</a>,\n<a href=\"https://www.gabriel.urdhr.fr/samsung-tv-upnp-dns-rebinding/\">smart TVs</a>, etc.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/03/22/samsung-tv-dial/", "title": "DNS rebinding and CSRF vulnerabilites on Samsung TV DIAL implementation", "url": "https://www.gabriel.urdhr.fr/2021/03/22/samsung-tv-dial/", "date_published": "2021-03-22T23:17:24+01:00", "date_modified": "2021-03-22T23:17:24+01:00", "tags": ["computer", "security", "vulnerability", "dial", "dns-rebinding", "csrf"], "content_html": "<p>I found\na DNS rebinding vulnerability as well as a Cross Site Request Forgery\n(CSRF) vulnerability\non the <a href=\"http://www.dial-multiscreen.org/\">DIAL</a> (Discovery And Launch)\nimplementation of the Samsung TV UE40F6320 (v1.0), from 2011.\nThis can be used to open any installed application (eg. Netflix and Youtube)\nand force the visualization of a given video in the applications.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/03/22/samsung-tv-upnp-dns-rebinding/", "title": "DNS rebinding vulnerability in Samsung SmartTV UPnP", "url": "https://www.gabriel.urdhr.fr/2021/03/22/samsung-tv-upnp-dns-rebinding/", "date_published": "2021-03-22T23:15:29+01:00", "date_modified": "2021-03-22T23:15:29+01:00", "tags": ["computer", "security", "vulnerability", "dns-rebinding", "upnp"], "content_html": "<p>I found\na DNS rebinding vulnerability on the Universal Plug-and-Play (UPnP)\ninterface of the Samsung TV UE40F6320 (v1.0), from 2011.\nThis could be used, for example, to change the channel, to know\nwhich channel is currently used or open the builtin browser to any URI.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/03/17/frida-disable-certificate-check-on-android/", "title": "Disable certificate verification on Android with Frida", "url": "https://www.gabriel.urdhr.fr/2021/03/17/frida-disable-certificate-check-on-android/", "date_published": "2021-03-17T00:00:00+01:00", "date_modified": "2021-03-17T00:00:00+01:00", "tags": ["computer", "system", "security", "android", "frida", "tls", "reverse-engineering"], "content_html": "<p>Some notes about how to write a <a href=\"https://frida.re/\">Frida</a> script\nwith the (somewhat classic) example of disabling certificate verification\nfor TLS communications on Android applications.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2020/09/23/dns-rebinding-freebox/", "title": "DNS rebinding vulnerabilities in Freebox", "url": "https://www.gabriel.urdhr.fr/2020/09/23/dns-rebinding-freebox/", "date_published": "2020-09-23T00:00:00+02:00", "date_modified": "2020-09-23T00:00:00+02:00", "tags": ["computer", "security", "vulnerability", "web", "upnp", "dns-rebinding", "csrf", "device", "privacy"], "content_html": "<p>I found some <a href=\"https://nitter.net/RedTeamPT/status/1318165465429061633\">DNS rebinding</a> vulnerabilities in <a href=\"https://www.free.fr/freebox/\">Freebox</a> devices\n(<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-24374\">CVE-2020-24374</a>,\n<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-24375\">CVE-2020-24375</a>,\n<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-24376\">CVE-2020-24376</a>,\n<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-24377\">CVE-2020-24377</a>)\nas well as a Cross Site Request Forgery (CSRF) vulnerability\n(<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-24373\">CVE-2020-24373</a>).\nThese vulnerabilities were <a href=\"https://dev.freebox.fr/blog/?p=10222\">fixed in 2020-08-05</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2019/02/12/yunohost-rce-csrf/", "title": "Remote code execution via cross site request forgery in InternetCube and YunoHost", "url": "https://www.gabriel.urdhr.fr/2019/02/12/yunohost-rce-csrf/", "date_published": "2019-02-12T00:00:00+01:00", "date_modified": "2019-02-12T00:00:00+01:00", "tags": ["computer", "web", "security", "yunohost", "csrf", "vulnerability"], "content_html": "<p>How I found remote code execution vulnerabilities\nvia <a href=\"https://marc.info/?l=bugtraq&amp;m=99263135911884&amp;w=2\">Cross Site Request Forgery</a> (CSRF)\non the administration interfaces\nof <a href=\"https://labriqueinter.net/\">InternetCube</a> applications\nand of the <a href=\"https://yunohost.org/\">YunoHost</a> administration interface\nwhich could have been used to execute arbitrary code as root.\nThese vulnerabilities were fixed in YunoHost 3.3, OpenVPN Client app 1.3.0.\nand YunoHost 3.4.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2018/05/30/more-browser-injections/", "title": "More example of argument and shell command injections in browser invocation", "url": "https://www.gabriel.urdhr.fr/2018/05/30/more-browser-injections/", "date_published": "2018-05-30T00:00:00+02:00", "date_modified": "2018-05-30T00:00:00+02:00", "tags": ["computer", "unix", "debian", "security", "shell", "vulnerability"], "content_html": "<p>In the <a href=\"https://www.gabriel.urdhr.fr/2018/05/28/browser-injections/\">previous episode</a>, I talked about\nsome argument and shell command injections vulnerabilities\nthrough URIs passed to browsers.\nHere I am evaluating some other CVEs\nwhich were registered at the same time (not by me).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2018/05/28/browser-injections/", "title": "Argument and shell command injections in browser invocation", "url": "https://www.gabriel.urdhr.fr/2018/05/28/browser-injections/", "date_published": "2018-05-28T00:00:00+02:00", "date_modified": "2018-05-28T00:00:00+02:00", "tags": ["computer", "unix", "debian", "security", "shell", "vulnerability", "freedesktop"], "content_html": "<p>I found an argument injection vulnerability\nrelated to the  handling of the <code>BROWSER</code> environment variable\nin <code>sensible-browser</code>.\nThis lead me (and others) to a few other arguments and shell command injection\nvulnerabilities in <code>BROWSER</code> processing and browser invocation in general.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2016/07/11/intel-amt-discovery/", "title": "Intel AMT discovery", "url": "https://www.gabriel.urdhr.fr/2016/07/11/intel-amt-discovery/", "date_published": "2016-07-11T00:00:00+02:00", "date_modified": "2020-11-19T13:29:26+01:00", "tags": ["computer", "amt", "python", "security"], "content_html": "<p>There has been some articles lately about Intel Active Management Technology (AMT)\nand its impact on\n<a href=\"http://invisiblethingslab.com/press/itl-press-2009-03.pdf\">security</a>,\ntrust,\nprivacy\nand <a href=\"https://www.fsf.org/blogs/community/active-management-technology\">free-software</a>.\nAMT supposed to be widely deployed in newest Intel hardware.\nSo I wanted to see if I could find some AMT devices in the wild.</p>\n"}]}