15 stories

Vulnerability Research

Explore comprehensive research and analysis on vulnerabilities, exploits, and security techniques, featuring insights into SQL injection, fuzzing, CVEs, and more by ProjectDiscovery and our community.

GitHub Enterprise SAML Authentication Bypass (CVE-2024-4985 / CVE-2024-9487)

Introduction In light of the recent Ruby-SAML bypass discovered in GitLab, we set out to examine the SAML implementation within GitHub Enterprise. During our research, we identified a significant vulnerability that enabled bypassing GitHub’s SAML authentication when encrypted assertions were in use. This blog post will provide an in-depth look at GitHub Enterprise’s SAML implementation and analyze the specific code issue that permitted this bypass. Although we uncovered this vulnerability inde

Vulnerability Research Nuclei & Templates

Ruby-SAML / GitLab Authentication Bypass (CVE-2024-45409)

Introduction In this blog post, we will analyze CVE-2024-45409, a critical vulnerability impacting Ruby-SAML, OmniAuth-SAML libraries, which effectively affects GitLab. This vulnerability allows an attacker to bypass SAML authentication mechanisms and gain unauthorized access by exploiting a flaw in how SAML responses are handled. The issue arises due to weaknesses in the verification of the digital signature used to protect SAML assertions, allowing attackers to manipulate the SAML response a

Vulnerability Research

Hacking Apple - SQL Injection to Remote Code Execution

Introduction In our last blog post, we delved into the inner workings of Lucee and took a look at the source code of Masa/Mura CMS, and the vastness of the potential attack surface struck us. It became evident that investing time in understanding the code could pay off. After dedicating a week to our exploration, we stumbled upon several entry points for exploitation, including a critical SQL injection flaw that we were able to exploit within Apple's Book Travel portal. In this blog post, we a

Vulnerability Research Nuclei & Templates

Hello Lucee! Let us hack Apple again?

Last year we conducted an in-depth analysis of multiple vulnerabilities within Adobe ColdFusion, we derived valuable insights, one of which revolved around CFM and CFC handling, parsing and execution. We wondered if there are any other CFML Servers. Does this ring a bell? Allow us to introduce Lucee. We've previously compromised Lucee's Admin panel, showcasing a pre-auth Remote Code Execution (RCE) on multiple Apple servers that utilized Lucee as its underlying server. Our journey led us throug

Vulnerability Research Nuclei & Templates

Atlassian Confluence - Remote Code Execution (CVE-2023-22527)

CVE-2023-22527 is a critical vulnerability within Atlassian's Confluence Server and Data Center. This vulnerability has the potential to permit unauthenticated attackers to inject OGNL expressions into the Confluence instance, thereby enabling the execution of arbitrary code and system commands. Technical Details Initial Analysis The CVE description provided by Atlassian made it clear that this vulnerability was automatically rendered unexploitable in version 8.5.4 due to certain incorpora

Vulnerability Research Nuclei & Templates

CrushFTP - CVE-2023-43177 Unauthenticated Remote Code Execution

CVE-2023-43177 is a critical vulnerability in CrushFTP. The vulnerability could potentially allow unauthenticated attackers with network access to the CrushFTP Instance to write files in the local file system and eventually in some versions could allow the executing of arbitrary system commands. Technical Details Based on the information shared in the original blog post at https://convergetp.com/2023/11/16/crushftp-zero-day-cve-2023-43177-discovered/, we embarked on an effort to gain a deeper

Vulnerability Research Nuclei & Templates

GameOver(lay) - Local Privilege Escalation in Ubuntu Kernel

GameOver(lay) encompasses two significant vulnerabilities within the Ubuntu kernel, CVE-2023-2640, and CVE-2023-32629, each carrying a high-severity rating with CVSS scores of 7.8. These vulnerabilities pose a critical threat, potentially affecting around 40% of Ubuntu users. The vulnerability lies within the OverlayFS module of the Ubuntu kernel, enabling a local attacker to execute a privilege escalation attack, granting unauthorized elevated access to the system. Technical Details CVE-2023

Vulnerability Research Nuclei & Templates

Atlassian Confluence Server (CVE-2023-22518) - Improper Authorization

CVE-2023-22518 is a critical vulnerability in Atlassian Confluence Data Center and Server. The vulnerability could potentially allow unauthenticated attackers with network access to the Confluence Instance to restore the database of the Confluence instance and eventually execute arbitrary system commands. Technical Details After performing a patch diff between the patched and unpatched versions, we identified the addition of two new annotations, namely, @WebSudoRequired and @SystemAdminOnly,

Vulnerability Research Nuclei & Templates

F5 BIG-IP Unauth RCE via AJP Smuggling (CVE-2023-46747) - Technical Analysis

Description: CVE-2023-46747 is a critical vulnerability in the F5 BIG-IP Configuration Utility identified as a request smuggling bug within the Apache JServ Protocol (AJP). The flaw could potentially allow unauthenticated attackers with network access to the BIG-IP system through the management port and/or self-IP addresses to execute arbitrary system commands. This vulnerability was discovered and reported by Thomas Hendrickson and Michael Weber of Praetorian Security. It has a CVSS score of 9

Vulnerability Research Nuclei & Templates

Don't Buy Another Scanner

Cyber threats have always been a part of the landscape of tech; from the first worm all the way to current supply chain and CI/CD vulnerabilities. What's different now is there seems to be an overwhelming amount of tools and solutions promising to be the silver bullet against security vulnerabilities. One of the most sought after tools, both from tool creators and users, is the "best" vulnerability scanner. There's a common misconception that the key to fortifying ourselves lies in the acquisiti

Vulnerability Research

JetBrains TeamCity RCE - CVE-2023-42793

A recently disclosed vulnerability in JetBrains can lead to Remote Code Execution. Are you up to date?

Vulnerability Research Nuclei & Templates

Adobe ColdFusion Pre-Auth RCE(s)

For the latest updates on CVE-2023-29300 / CVE-2023-38203 / CVE-2023-38204, see the updates section Introduction The Adobe ColdFusion, widely recognized for its robust web development capabilities, recently released a critical security update. The update specifically targeted three security issues, among them, CVE-2023-29300, a highly concerning pre-authentication Remote Code Execution (RCE) vulnerability. This vulnerability poses a significant threat, allowing malicious actors to execute arb

Vulnerability Research Nuclei & Templates

Vulnerability Research

GitHub Enterprise SAML Authentication Bypass (CVE-2024-4985 / CVE-2024-9487)

Ruby-SAML / GitLab Authentication Bypass (CVE-2024-45409)

Hacking Apple - SQL Injection to Remote Code Execution

Hello Lucee! Let us hack Apple again?

Atlassian Confluence - Remote Code Execution (CVE-2023-22527)

CrushFTP - CVE-2023-43177 Unauthenticated Remote Code Execution

GameOver(lay) - Local Privilege Escalation in Ubuntu Kernel

Atlassian Confluence Server (CVE-2023-22518) - Improper Authorization

F5 BIG-IP Unauth RCE via AJP Smuggling (CVE-2023-46747) - Technical Analysis

Don't Buy Another Scanner

JetBrains TeamCity RCE - CVE-2023-42793

Adobe ColdFusion Pre-Auth RCE(s)

Monitor your infrastructure

Talk to sales

Platform

Open Source

Resources

Company