{"version": "https://jsonfeed.org/version/1", "title": "/dev/posts/ - Tag index - vulnerability", "home_page_url": "https://www.gabriel.urdhr.fr", "feed_url": "/tags/vulnerability/feed.json", "items": [{"id": "http://www.gabriel.urdhr.fr/2023/06/08/arbitrary-file-write-in-stellarium-file-association/", "title": "Arbitrary file write in Stellarium file association", "url": "https://www.gabriel.urdhr.fr/2023/06/08/arbitrary-file-write-in-stellarium-file-association/", "date_published": "2023-06-08T23:20:04+02:00", "date_modified": "2023-06-08T23:20:04+02:00", "tags": ["computer", "security", "vulnerability"], "content_html": "<p>I found an arbitrary file write vulnerability (through path traversal)\nwhich would be exploited\nfor arbitrary code execution in <a href=\"https://stellarium.org/\">Stellarium</a> (desktop version).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/03/07/mime-type-spoofing/", "title": "MIME-type spoofing in Firefox/Thunderbird and file managers", "url": "https://www.gabriel.urdhr.fr/2023/03/07/mime-type-spoofing/", "date_published": "2023-03-07T00:00:00+01:00", "date_modified": "2023-03-07T00:00:00+01:00", "tags": ["computer", "web", "security", "vulnerability", "firefox", "freedesktop", "thunderbird"], "content_html": "<p>An interesting spoofing attack\nresulting from the interaction\nbetween Firefox (or Thunderbird)\nMIME types handling and file managers.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/02/28/rce-file-association-debian-mono/", "title": "Code execution through MIME-type association of Mono interpreter", "url": "https://www.gabriel.urdhr.fr/2023/02/28/rce-file-association-debian-mono/", "date_published": "2023-02-28T00:00:00+01:00", "date_modified": "2023-02-28T00:00:00+01:00", "tags": ["computer", "web", "security", "vulnerability", "debian", "freedesktop", "mono"], "content_html": "<p>A dangerous file type association in <a href=\"https://www.debian.org/\">Debian</a>\nwhich could be used to trigger arbitrary code execution.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/05/05/browser-mediated-attacks-on-webdriver/", "title": "Browser-based attacks on WebDriver implementations", "url": "https://www.gabriel.urdhr.fr/2022/05/05/browser-mediated-attacks-on-webdriver/", "date_published": "2022-05-05T00:00:00+02:00", "date_modified": "2022-05-05T00:00:00+02:00", "tags": ["computer", "security", "web", "vulnerability", "webdriver", "firefox", "dns-rebinding", "csrf"], "content_html": "<p>Some context and analysis about attacks on\nin <a href=\"https://www.w3.org/TR/webdriver/\">WebDriver</a> implementations.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/03/24/zap-no-certificate-validation/", "title": "Lack of X.509 TLS certificate validation in OWASP ZAP", "url": "https://www.gabriel.urdhr.fr/2022/03/24/zap-no-certificate-validation/", "date_published": "2022-03-24T00:00:00+01:00", "date_modified": "2022-03-24T00:00:00+01:00", "tags": ["computer", "security", "zap", "tls", "vulnerability"], "content_html": "<p>Lack of X.509 TLS certificate validation in OWASP <a href=\"https://www.zaproxy.org/\">ZAP</a>\n(Zed Attack Proxy)\ncould be used for man-in-the-middle attacks.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/03/15/dns-rebinding-readymedia/", "title": "DNS rebinding on ReadyMedia/minidlna v1.3.0 and below", "url": "https://www.gabriel.urdhr.fr/2022/03/15/dns-rebinding-readymedia/", "date_published": "2022-03-15T00:00:00+01:00", "date_modified": "2022-03-15T00:00:00+01:00", "tags": ["computer", "security", "upnp", "dns-rebinding", "vulnerability"], "content_html": "<p>A DNS rebinding vulnerability I found\nin <a href=\"https://sourceforge.net/projects/minidlna/\">ReadyMedia</a> (formerly MiniDLNA)\nv1.3.0 and below.\nThis is <a href=\"https://nvd.nist.gov/vuln/detail/CVE-2022-26505\">CVE-2022-26505</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/", "title": "CSRF and DNS-rebinding to RCE in Selenium Server (Grid)", "url": "https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/", "date_published": "2022-02-07T22:15:00+01:00", "date_modified": "2022-02-07T22:15:00+01:00", "tags": ["computer", "security", "web", "vulnerability", "webdriver", "csrf", "dns-rebinding"], "content_html": "<p>Vulnerabilities in found on the <a href=\"https://www.w3.org/TR/webdriver2/\">WebDriver</a>\nendpoints of Selenium Server (Grid).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/02/07/geckodriver-dns-rebinding-rce/", "title": "DNS rebinding vulnerability to RCE in GeckoDriver", "url": "https://www.gabriel.urdhr.fr/2022/02/07/geckodriver-dns-rebinding-rce/", "date_published": "2022-02-07T22:10:00+01:00", "date_modified": "2022-02-07T22:10:00+01:00", "tags": ["computer", "security", "web", "vulnerability", "webdriver", "firefox", "dns-rebinding"], "content_html": "<p>A DNS rebinding vulnerability I found in\nGeckoDriver which could be used to execute arbitrary shell commands.\nThis is bug <a href=\"https://bugzilla.mozilla.org/show_bug.cgi?id=1652612\">#1652612</a>\nand <a href=\"https://nvd.nist.gov/vuln/detail/CVE-2021-4138\">CVE-2021-4138</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/08/16/chromedriver-cross-origin-request-forgery-rce/", "title": "Cross-origin/same-site request forgery to RCE in chromedriver", "url": "https://www.gabriel.urdhr.fr/2021/08/16/chromedriver-cross-origin-request-forgery-rce/", "date_published": "2021-08-16T23:22:56+02:00", "date_modified": "2022-02-13T23:19:32+01:00", "tags": ["computer", "security", "web", "vulnerability", "webdriver", "csrf"], "content_html": "<p>I found a cross-origin/same-site request forgery vulnerability\nin chromedriver.\nIt was <a href=\"https://bugs.chromium.org/p/chromium/issues/detail?id=1100097\">rejected</a> (won't fix) because it is only\npossible to trigger this from the cross-origin/same-site and not cross-site.\nIn practice, it means it is really only possible to trigger this from another\nlocalhost-bound web application.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/08/16/geckodriver-csrf-rce/", "title": "CSRF to RCE in GeckoDriver", "url": "https://www.gabriel.urdhr.fr/2021/08/16/geckodriver-csrf-rce/", "date_published": "2021-08-16T23:00:48+02:00", "date_modified": "2021-08-16T23:00:48+02:00", "tags": ["computer", "security", "web", "vulnerability", "webdriver", "firefox", "csrf"], "content_html": "<p>A Cross-Site Request Forgery (CSRF) vulnerability I found in\nGeckoDriver which could be used to execute arbitrary shell commands.\n<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-15660\">CVE-2020-15660</a>\nhas been assigned to this vulnerability.\nThis was fixed by <a href=\"https://github.com/mozilla/geckodriver/releases/tag/v0.27.0\">GeckoDriver v0.27.0</a>\nin 2020-07-27.\nThis is <a href=\"https://bugzilla.mozilla.org/show_bug.cgi?id=1648964\">bug #1648964</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/06/24/gupnp-dns-rebinding/", "title": "DNS rebinding vulnerability in GUPnP", "url": "https://www.gabriel.urdhr.fr/2021/06/24/gupnp-dns-rebinding/", "date_published": "2021-06-24T00:00:00+02:00", "date_modified": "2021-07-05T18:50:55+02:00", "tags": ["computer", "security", "upnp", "dns-rebinding", "vulnerability"], "content_html": "<p>GUPnP, a GNOME library for Universal Plug and Play (UPnP),\nwas vulnerable to <a href=\"https://www.gabriel.urdhr.fr/2021/06/02/dns-rebinding-explained/\">DNS rebinding</a> attacks.\nThis is <a href=\"https://nvd.nist.gov/vuln/detail/CVE-2021-33516\">CVE-2021-33516</a>\nand <a href=\"https://gitlab.gnome.org/GNOME/gupnp/-/issues/24\">GUPnP issue #24</a>.\nThis <a href=\"https://discourse.gnome.org/t/security-relevant-releases-for-gupnp-issue-cve-2021-33516/6536/3\">was fixed</a>\nin GUPnP 1.0.7 and GUPnP 1.2.5.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/06/12/pupnp-dns-rebinding/", "title": "DNS rebinding vulnerability in pupnp and npupnp", "url": "https://www.gabriel.urdhr.fr/2021/06/12/pupnp-dns-rebinding/", "date_published": "2021-06-12T00:00:00+02:00", "date_modified": "2021-06-12T00:00:00+02:00", "tags": ["computer", "security", "upnp", "dns-rebinding", "vulnerability"], "content_html": "<p>I found that <a href=\"https://github.com/pupnp/pupnp\">pupnp</a> was vulnerable to DNS rebinding attacks.\n<a href=\"https://framagit.org/medoc92/npupnp\">npupnp</a>, a fork a pupnp, was impacted as well.\nThis is demonstrated using Gerbera a UPnP MediaServer.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/04/05/firefox-doh-dns-rebinding-protection-bypass/", "title": "Firefox DoH DNS rebinding protection bypass using IPv4-mapped addresses", "url": "https://www.gabriel.urdhr.fr/2021/04/05/firefox-doh-dns-rebinding-protection-bypass/", "date_published": "2021-04-05T00:00:00+02:00", "date_modified": "2021-04-05T00:00:00+02:00", "tags": ["computer", "security", "vulnerability", "web", "dns-rebinding", "firefox"], "content_html": "<p>I found that\nthe filtering of private IPv4 addresses\nin the <a href=\"https://tools.ietf.org/html/rfc8484\">DNS-over-HTTPS</a> (DoH) implementation of Firefox could by bypassed.\nThis is <a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-26961\">CVE-2020-26961</a>\nand <a href=\"https://bugzilla.mozilla.org/show_bug.cgi?id=1672528\">Mozilla bug 1672528</a>.\nIt has been fixed in <a href=\"https://www.mozilla.org/en-US/security/advisories/mfsa2020-50/\">Firefox 83</a>,\n<a href=\"https://www.mozilla.org/en-US/security/advisories/mfsa2020-51/\">Firefox ESR 78.5</a>\nand <a href=\"https://www.mozilla.org/en-US/security/advisories/mfsa2020-52/\">Thunderbird 78.5</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/03/22/samsung-tv-dial/", "title": "DNS rebinding and CSRF vulnerabilites on Samsung TV DIAL implementation", "url": "https://www.gabriel.urdhr.fr/2021/03/22/samsung-tv-dial/", "date_published": "2021-03-22T23:17:24+01:00", "date_modified": "2021-03-22T23:17:24+01:00", "tags": ["computer", "security", "vulnerability", "dial", "dns-rebinding", "csrf"], "content_html": "<p>I found\na DNS rebinding vulnerability as well as a Cross Site Request Forgery\n(CSRF) vulnerability\non the <a href=\"http://www.dial-multiscreen.org/\">DIAL</a> (Discovery And Launch)\nimplementation of the Samsung TV UE40F6320 (v1.0), from 2011.\nThis can be used to open any installed application (eg. Netflix and Youtube)\nand force the vizualisation of a given video in the applications.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/03/22/samsung-tv-upnp-dns-rebinding/", "title": "DNS rebinding vulnerability in Samsung SmartTV UPnP", "url": "https://www.gabriel.urdhr.fr/2021/03/22/samsung-tv-upnp-dns-rebinding/", "date_published": "2021-03-22T23:15:29+01:00", "date_modified": "2021-03-22T23:15:29+01:00", "tags": ["computer", "security", "vulnerability", "dns-rebinding", "upnp"], "content_html": "<p>I found\na DNS rebinding vulnerability on the Universal Plug-and-Play (UPnP)\ninterface of the Samsung TV UE40F6320 (v1.0), from 2011.\nThis could be used, for example, to change the channel, to know\nwhich channel is currently used or open the builtin browser to any URI.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2020/09/23/dns-rebinding-freebox/", "title": "DNS rebinding vulnerabilities in Freebox", "url": "https://www.gabriel.urdhr.fr/2020/09/23/dns-rebinding-freebox/", "date_published": "2020-09-23T00:00:00+02:00", "date_modified": "2020-09-23T00:00:00+02:00", "tags": ["computer", "security", "vulnerability", "web", "upnp", "dns-rebinding", "csrf", "device", "privacy"], "content_html": "<p>I found some <a href=\"https://nitter.net/RedTeamPT/status/1318165465429061633\">DNS rebinding</a> vulnerabilities in <a href=\"https://www.free.fr/freebox/\">Freebox</a> devices\n(<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-24374\">CVE-2020-24374</a>,\n<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-24375\">CVE-2020-24375</a>,\n<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-24376\">CVE-2020-24376</a>,\n<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-24377\">CVE-2020-24377</a>)\nas well as a Cross Site Request Forgery (CSRF) vulnerability\n(<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-24373\">CVE-2020-24373</a>).\nThese vulnerabilities were <a href=\"https://dev.freebox.fr/blog/?p=10222\">fixed in 2020-08-05</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2019/02/12/yunohost-rce-csrf/", "title": "Remote code execution via cross site request forgery in InternetCube and YunoHost", "url": "https://www.gabriel.urdhr.fr/2019/02/12/yunohost-rce-csrf/", "date_published": "2019-02-12T00:00:00+01:00", "date_modified": "2019-02-12T00:00:00+01:00", "tags": ["computer", "web", "security", "yunohost", "csrf", "vulnerability"], "content_html": "<p>How I found remote code execution vulnerabilities\nvia <a href=\"https://marc.info/?l=bugtraq&amp;m=99263135911884&amp;w=2\">Cross Site Request Forgery</a> (CSRF)\non the administration interfaces\nof <a href=\"https://labriqueinter.net/\">InternetCube</a> applications\nand of the <a href=\"https://yunohost.org/\">YunoHost</a> administration interface\nwhich could have been used to execute arbitrary code as root.\nThese vulnerabilities were fixed in YunoHost 3.3, OpenVPN Client app 1.3.0.\nand YunoHost 3.4.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2018/05/30/more-browser-injections/", "title": "More example of argument and shell command injections in browser invocation", "url": "https://www.gabriel.urdhr.fr/2018/05/30/more-browser-injections/", "date_published": "2018-05-30T00:00:00+02:00", "date_modified": "2018-05-30T00:00:00+02:00", "tags": ["computer", "unix", "debian", "security", "shell", "vulnerability"], "content_html": "<p>In the <a href=\"https://www.gabriel.urdhr.fr/2018/05/28/browser-injections/\">previous episode</a>, I talked about\nsome argument and shell command injections vulnerabilities\nthrough URIs passed to browsers.\nHere I am evaluating some other CVEs\nwhich were registered at the same time (not by me).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2018/05/28/browser-injections/", "title": "Argument and shell command injections in browser invocation", "url": "https://www.gabriel.urdhr.fr/2018/05/28/browser-injections/", "date_published": "2018-05-28T00:00:00+02:00", "date_modified": "2018-05-28T00:00:00+02:00", "tags": ["computer", "unix", "debian", "security", "shell", "vulnerability", "freedesktop"], "content_html": "<p>I found an argument injection vulnerability\nrelated to the  handling of the <code>BROWSER</code> environment variable\nin <code>sensible-browser</code>.\nThis lead me (and others) to a few other arguments and shell command injection\nvulnerabilities in <code>BROWSER</code> processing and browser invocation in general.</p>\n"}]}