OAuth 2.x and OpenID Connect sequence diagrams
Published:
Some sequence diagrams about OAuth 2.x and OpenID Connect.
Browser-based attacks on WebDriver implementations
Published:
Some context and analysis about attacks on in WebDriver implementations.
Introduction to TLS v1.3
Published:
Some notes about how TLS v1.3 works. This is a follow-up of the previous episode about TLS v1.2. As before, the goal is to have a high-level overview about how the protocol works, what is the role of the different messages and be able to understand (and debug) a network traffic dump.
CSRF and DNS-rebinding to RCE in Selenium Server (Grid)
Published:
Vulnerabilities in found on the WebDriver endpoints of Selenium Server (Grid).
DNS rebinding vulnerability to RCE in GeckoDriver
Published:
A DNS rebinding vulnerability I found in GeckoDriver which could be used to execute arbitrary shell commands. This is bug #1652612 and CVE-2021-4138.
Introduction to TLS v1.2
Published:
Some notes about how TLS v1.2 (Transport Layer Security) works. The goal explain what is going on in a network traffic dump, the role of the different TLS extensions, the impact of the different cipher suites on security, etc. It includes several diagrams and many references.
Cross-origin/same-site request forgery to RCE in chromedriver
Published:
I found a cross-origin/same-site request forgery vulnerability in chromedriver. It was rejected (won't fix) because it is only possible to trigger this from the cross-origin/same-site and not cross-site. In practice, it means it is really only possible to trigger this from another localhost-bound web application.
CSRF to RCE in GeckoDriver
Published:
A Cross-Site Request Forgery (CSRF) vulnerability I found in GeckoDriver which could be used to execute arbitrary shell commands. CVE-2020-15660 has been assigned to this vulnerability. This was fixed by GeckoDriver v0.27.0 in 2020-07-27. This is bug #1648964.
Firefox DoH DNS rebinding protection bypass using IPv4-mapped addresses
Published:
I found that the filtering of private IPv4 addresses in the DNS-over-HTTPS (DoH) implementation of Firefox could by bypassed. This is CVE-2020-26961 and Mozilla bug 1672528. It has been fixed in Firefox 83, Firefox ESR 78.5 and Thunderbird 78.5.
DNS rebinding vulnerabilities in Freebox
Published:
I found some DNS rebinding vulnerabilities in Freebox devices (CVE-2020-24374, CVE-2020-24375, CVE-2020-24376, CVE-2020-24377) as well as a Cross Site Request Forgery (CSRF) vulnerability (CVE-2020-24373). These vulnerabilities were fixed in 2020-08-05.
Page 2 of 3 | Previous page | Next page | JSON Feed | Atom Feed | RSS Feed