{"version": "https://jsonfeed.org/version/1", "title": "/dev/posts/ - Tag index - web", "home_page_url": "https://www.gabriel.urdhr.fr", "feed_url": "/tags/web/feed.json", "items": [{"id": "http://www.gabriel.urdhr.fr/2025/07/08/keycloak-uma-vulnerabilities/", "title": "Keycloak UMA vulnerabilities", "url": "https://www.gabriel.urdhr.fr/2025/07/08/keycloak-uma-vulnerabilities/", "date_published": "2025-07-08T00:00:00+02:00", "date_modified": "2025-07-08T00:00:00+02:00", "tags": ["computer", "protocol", "web", "security", "oauth", "keycloak", "security", "uma", "openid-connect"], "content_html": "<p>Keycloak's UMA implementation seems tricky to me.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2025/03/18/uma-malicious-as/", "title": "Malicious authorization server attack in UMA\u00a02.0", "url": "https://www.gabriel.urdhr.fr/2025/03/18/uma-malicious-as/", "date_published": "2025-03-18T21:23:51+01:00", "date_modified": "2025-03-18T21:23:51+01:00", "tags": ["computer", "protocol", "web", "security", "oauth", "uma"], "content_html": "<p>In a <a href=\"https://www.gabriel.urdhr.fr/2025/03/18/uma-pass-the-permission-token/\">previous post</a>,\nI described a pass-the-permission-ticket vulnerability in UMA\u00a02.0\nin which a malicious UMA resource server\ncould kindly ask a UMA client\nto give it access tokens actually intended for another UMA resource server.\nIn this post,\nI am describing a similar attack when the authorization server is malicious.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2025/03/18/uma-pass-the-permission-token/", "title": "Pass-the-permission-ticket vulnerability in UMA\u00a02.0", "url": "https://www.gabriel.urdhr.fr/2025/03/18/uma-pass-the-permission-token/", "date_published": "2025-03-18T21:23:50+01:00", "date_modified": "2025-03-18T21:23:50+01:00", "tags": ["computer", "protocol", "web", "security", "oauth", "uma"], "content_html": "<p>In the <a href=\"https://docs.kantarainitiative.org/uma/wg/rec-oauth-uma-grant-2.0.html\">User-Managed Access</a> (UMA) 2.0 protocol,\na malicious resource server (or a malicious server acting as a resource server)\ncan obtain a requesting party (access) token (RPT)\nintended for another UMA resource server\nfrom a UMA client\nby passing a permission ticket obtained from the target resource server to the UMA client.\nThis can compromise the privacy (confidentiality)\nand integrity of UMA protected resources.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2024/10/22/websub-sequence-diagram/", "title": "WebSub sequence diagram", "url": "https://www.gabriel.urdhr.fr/2024/10/22/websub-sequence-diagram/", "date_published": "2024-10-22T00:00:00+02:00", "date_modified": "2024-10-22T00:00:00+02:00", "tags": ["computer", "web", "websub"], "content_html": "<p>A sequence diagram for <a href=\"https://www.w3.org/TR/websub/\">WebSub</a> (formerly PubSubHubbub).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2024/09/08/on-ad-blockers/", "title": "The FBI recommends using ad blockers", "url": "https://www.gabriel.urdhr.fr/2024/09/08/on-ad-blockers/", "date_published": "2024-09-08T00:00:00+02:00", "date_modified": "2024-09-08T00:00:00+02:00", "tags": ["computer", "web", "security", "privacy"], "content_html": "<p>An interesting note from the FBI.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2024/06/17/uma2-diagrams/", "title": "UMA 2.0 diagrams", "url": "https://www.gabriel.urdhr.fr/2024/06/17/uma2-diagrams/", "date_published": "2024-06-17T00:00:00+02:00", "date_modified": "2024-06-17T00:00:00+02:00", "tags": ["computer", "protocol", "web", "security", "oauth", "uma"], "content_html": "<p>Some diagrams (mostly sequence diagrams) about UMA 2.0.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/03/07/mime-type-spoofing/", "title": "MIME-type spoofing in Firefox/Thunderbird and file managers", "url": "https://www.gabriel.urdhr.fr/2023/03/07/mime-type-spoofing/", "date_published": "2023-03-07T00:00:00+01:00", "date_modified": "2023-03-07T00:00:00+01:00", "tags": ["computer", "web", "security", "vulnerability", "firefox", "freedesktop", "thunderbird"], "content_html": "<p>An interesting spoofing attack\nresulting from the interaction\nbetween Firefox (or Thunderbird)\nMIME types handling and file managers.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/02/28/rce-file-association-debian-mono/", "title": "Code execution through MIME-type association of Mono interpreter", "url": "https://www.gabriel.urdhr.fr/2023/02/28/rce-file-association-debian-mono/", "date_published": "2023-02-28T00:00:00+01:00", "date_modified": "2023-02-28T00:00:00+01:00", "tags": ["computer", "web", "security", "vulnerability", "debian", "freedesktop", "mono"], "content_html": "<p>A dangerous file type association in <a href=\"https://www.debian.org/\">Debian</a>\nwhich could be used to trigger arbitrary code execution.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2023/02/06/oauth2-diagrams/", "title": "OAuth 2.x and OpenID Connect sequence diagrams", "url": "https://www.gabriel.urdhr.fr/2023/02/06/oauth2-diagrams/", "date_published": "2023-02-06T00:00:00+01:00", "date_modified": "2026-01-09T11:59:47+01:00", "tags": ["computer", "protocol", "web", "security", "oauth", "openid-connect", "keycloak"], "content_html": "<p>Some sequence diagrams about OAuth 2.x and OpenID Connect.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/05/05/browser-mediated-attacks-on-webdriver/", "title": "Browser-based attacks on WebDriver implementations", "url": "https://www.gabriel.urdhr.fr/2022/05/05/browser-mediated-attacks-on-webdriver/", "date_published": "2022-05-05T00:00:00+02:00", "date_modified": "2022-05-05T00:00:00+02:00", "tags": ["computer", "security", "web", "vulnerability", "webdriver", "firefox", "dns-rebinding", "csrf"], "content_html": "<p>Some context and analysis about attacks on\nin <a href=\"https://www.w3.org/TR/webdriver/\">WebDriver</a> implementations.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/02/26/tls1.3-intro/", "title": "Introduction to TLS v1.3", "url": "https://www.gabriel.urdhr.fr/2022/02/26/tls1.3-intro/", "date_published": "2022-02-26T00:00:00+01:00", "date_modified": "2024-11-23T01:15:07+01:00", "tags": ["computer", "web", "network", "tls", "cryptography"], "content_html": "<p>Some notes about how <a href=\"https://datatracker.ietf.org/doc/html/rfc8446\">TLS v1.3</a> works.\nThis is a follow-up of the <a href=\"https://www.gabriel.urdhr.fr/2021/11/30/tls1.2-intro/\">previous episode</a>\nabout <a href=\"https://datatracker.ietf.org/doc/html/rfc5246\">TLS v1.2</a>.\nAs before, the goal is to have a high-level overview\nabout how the protocol works,\nwhat is the role of the different messages\nand be able to understand (and debug) a network traffic dump.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/", "title": "CSRF and DNS-rebinding to RCE in Selenium Server (Grid)", "url": "https://www.gabriel.urdhr.fr/2022/02/07/selenium-standalone-server-csrf-dns-rebinding-rce/", "date_published": "2022-02-07T22:15:00+01:00", "date_modified": "2022-02-07T22:15:00+01:00", "tags": ["computer", "security", "web", "vulnerability", "webdriver", "csrf", "dns-rebinding"], "content_html": "<p>Vulnerabilities in found on the <a href=\"https://www.w3.org/TR/webdriver2/\">WebDriver</a>\nendpoints of Selenium Server (Grid).</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2022/02/07/geckodriver-dns-rebinding-rce/", "title": "DNS rebinding vulnerability to RCE in GeckoDriver", "url": "https://www.gabriel.urdhr.fr/2022/02/07/geckodriver-dns-rebinding-rce/", "date_published": "2022-02-07T22:10:00+01:00", "date_modified": "2022-02-07T22:10:00+01:00", "tags": ["computer", "security", "web", "vulnerability", "webdriver", "firefox", "dns-rebinding"], "content_html": "<p>A DNS rebinding vulnerability I found in\nGeckoDriver which could be used to execute arbitrary shell commands.\nThis is bug <a href=\"https://bugzilla.mozilla.org/show_bug.cgi?id=1652612\">#1652612</a>\nand <a href=\"https://nvd.nist.gov/vuln/detail/CVE-2021-4138\">CVE-2021-4138</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/11/30/tls1.2-intro/", "title": "Introduction to TLS v1.2", "url": "https://www.gabriel.urdhr.fr/2021/11/30/tls1.2-intro/", "date_published": "2021-11-30T00:00:00+01:00", "date_modified": "2024-11-23T01:15:07+01:00", "tags": ["computer", "web", "network", "tls", "cryptography"], "content_html": "<p>Some notes\nabout how <a href=\"https://datatracker.ietf.org/doc/html/rfc5246\">TLS v1.2</a>\n(Transport Layer Security) works.\nThe goal explain what is going on in a network traffic dump,\nthe role of the different TLS extensions,\nthe impact of the different cipher suites on security, etc.\nIt includes several diagrams and many references.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/08/16/chromedriver-cross-origin-request-forgery-rce/", "title": "Cross-origin/same-site request forgery to RCE in chromedriver", "url": "https://www.gabriel.urdhr.fr/2021/08/16/chromedriver-cross-origin-request-forgery-rce/", "date_published": "2021-08-16T23:22:56+02:00", "date_modified": "2022-02-13T23:19:32+01:00", "tags": ["computer", "security", "web", "vulnerability", "webdriver", "csrf"], "content_html": "<p>I found a cross-origin/same-site request forgery vulnerability\nin chromedriver.\nIt was <a href=\"https://bugs.chromium.org/p/chromium/issues/detail?id=1100097\">rejected</a> (won't fix) because it is only\npossible to trigger this from the cross-origin/same-site and not cross-site.\nIn practice, it means it is really only possible to trigger this from another\nlocalhost-bound web application.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/08/16/geckodriver-csrf-rce/", "title": "CSRF to RCE in GeckoDriver", "url": "https://www.gabriel.urdhr.fr/2021/08/16/geckodriver-csrf-rce/", "date_published": "2021-08-16T23:00:48+02:00", "date_modified": "2021-08-16T23:00:48+02:00", "tags": ["computer", "security", "web", "vulnerability", "webdriver", "firefox", "csrf"], "content_html": "<p>A Cross-Site Request Forgery (CSRF) vulnerability I found in\nGeckoDriver which could be used to execute arbitrary shell commands.\n<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-15660\">CVE-2020-15660</a>\nhas been assigned to this vulnerability.\nThis was fixed by <a href=\"https://github.com/mozilla/geckodriver/releases/tag/v0.27.0\">GeckoDriver v0.27.0</a>\nin 2020-07-27.\nThis is <a href=\"https://bugzilla.mozilla.org/show_bug.cgi?id=1648964\">bug #1648964</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2021/04/05/firefox-doh-dns-rebinding-protection-bypass/", "title": "Firefox DoH DNS rebinding protection bypass using IPv4-mapped addresses", "url": "https://www.gabriel.urdhr.fr/2021/04/05/firefox-doh-dns-rebinding-protection-bypass/", "date_published": "2021-04-05T00:00:00+02:00", "date_modified": "2021-04-05T00:00:00+02:00", "tags": ["computer", "security", "vulnerability", "web", "dns-rebinding", "firefox"], "content_html": "<p>I found that\nthe filtering of private IPv4 addresses\nin the <a href=\"https://tools.ietf.org/html/rfc8484\">DNS-over-HTTPS</a> (DoH) implementation of Firefox could by bypassed.\nThis is <a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-26961\">CVE-2020-26961</a>\nand <a href=\"https://bugzilla.mozilla.org/show_bug.cgi?id=1672528\">Mozilla bug 1672528</a>.\nIt has been fixed in <a href=\"https://www.mozilla.org/en-US/security/advisories/mfsa2020-50/\">Firefox 83</a>,\n<a href=\"https://www.mozilla.org/en-US/security/advisories/mfsa2020-51/\">Firefox ESR 78.5</a>\nand <a href=\"https://www.mozilla.org/en-US/security/advisories/mfsa2020-52/\">Thunderbird 78.5</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2020/09/23/dns-rebinding-freebox/", "title": "DNS rebinding vulnerabilities in Freebox", "url": "https://www.gabriel.urdhr.fr/2020/09/23/dns-rebinding-freebox/", "date_published": "2020-09-23T00:00:00+02:00", "date_modified": "2020-09-23T00:00:00+02:00", "tags": ["computer", "security", "vulnerability", "web", "upnp", "dns-rebinding", "csrf", "device"], "content_html": "<p>I found some <a href=\"https://nitter.net/RedTeamPT/status/1318165465429061633\">DNS rebinding</a> vulnerabilities in <a href=\"https://www.free.fr/freebox/\">Freebox</a> devices\n(<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-24374\">CVE-2020-24374</a>,\n<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-24375\">CVE-2020-24375</a>,\n<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-24376\">CVE-2020-24376</a>,\n<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-24377\">CVE-2020-24377</a>)\nas well as a Cross Site Request Forgery (CSRF) vulnerability\n(<a href=\"https://nvd.nist.gov/vuln/detail/CVE-2020-24373\">CVE-2020-24373</a>).\nThese vulnerabilities were <a href=\"https://dev.freebox.fr/blog/?p=10222\">fixed in 2020-08-05</a>.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2019/02/12/yunohost-rce-csrf/", "title": "Remote code execution via cross site request forgery in InternetCube and YunoHost", "url": "https://www.gabriel.urdhr.fr/2019/02/12/yunohost-rce-csrf/", "date_published": "2019-02-12T00:00:00+01:00", "date_modified": "2019-02-12T00:00:00+01:00", "tags": ["computer", "web", "security", "yunohost", "csrf", "vulnerability"], "content_html": "<p>How I found remote code execution vulnerabilities\nvia <a href=\"https://marc.info/?l=bugtraq&amp;m=99263135911884&amp;w=2\">Cross Site Request Forgery</a> (CSRF)\non the administration interfaces\nof <a href=\"https://labriqueinter.net/\">InternetCube</a> applications\nand of the <a href=\"https://yunohost.org/\">YunoHost</a> administration interface\nwhich could have been used to execute arbitrary code as root.\nThese vulnerabilities were fixed in YunoHost 3.3, OpenVPN Client app 1.3.0.\nand YunoHost 3.4.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2018/11/22/south-park-ip-address-spoofing/", "title": "IP address spoofing in order to watch South Park", "url": "https://www.gabriel.urdhr.fr/2018/11/22/south-park-ip-address-spoofing/", "date_published": "2018-11-22T00:00:00+01:00", "date_modified": "2018-11-22T00:00:00+01:00", "tags": ["computer", "web", "hack", "firefox"], "content_html": "<p>Trying to bring back some old IP spoofing Firefox extension\nfor watching South Park episodes.</p>\n"}, {"id": "http://www.gabriel.urdhr.fr/2015/07/04/html-pipeline-middleman/", "title": "Use HTML pipeline in Middleman", "url": "https://www.gabriel.urdhr.fr/2015/07/04/html-pipeline-middleman/", "date_published": "2015-07-04T00:00:00+02:00", "date_modified": "2015-07-04T00:00:00+02:00", "tags": ["computer", "middleman", "ruby", "html", "emoji", "markdown", "web"], "content_html": "<p>How to use <a href=\"https://github.com/jch/html-pipeline\"><code>html-pipeline</code></a> in\n<a href=\"https://middlemanapp.com/\">middleman</a>.</p>\n"}]}