Date archives: October 26, 2022

Introduction Once in a while, you come across the perfect storm of vulnerabilities that may be assessed as a medium risk on their own, but when combined they can lead to a critical impact. In this blog post, we detail our journey in auditing a network monitoring software called WhatsUp...

Summary The following vulnerabilities were discovered in Progress Ipswitch WhatsUp Gold: CVE-2022-29845: Local File Disclosure CVE-2022-29846: WhatsUp Gold Serial Number Disclosure CVE-2022-29847: Unauthenticated Server-Side Request Forgery (SSRF) CVE-2022-29848: Authenticated Server-Side Request Forgery (SSRF) The adivsory from Progress can be found here. Impact When combined, these vulnerabilities lead to a critical...

  Introduction Let’s try this again Now, with added Kubernetes! Scanning & The Network Boundaries The Kubelet API: Git secrets redux Conclusion Introduction Following on from our 2nd story, we’ll be continuing the epic tale of our research into Cloudflare pages in this third installment. If you haven’t read part...

  Introduction OrangeRa1n Jailbreak Conclusion Part 3 Introduction Following on from our 1st story, we’ll be continuing the epic tale of our research into Cloudflare pages in this second installment. If you haven’t read part 1, you can read it here. We pick up where we left off, after harvesting...

  Introduction Overview of Cloudflare Pages 🤔 Diving Deeper into Cloudflare Pages The Treasure Map The CTF Command Injection in CLONE_REPO Command Injection in PUBLIC_ASSETS chmod 777 Path Injection Part 2 Introduction Before we get into this lengthy post, we’d like to thank both Cloudflare and HackerOne for working with...

  Introduction What is dotCMS? Code Analysis Making a PoC Hacking a Bank Vendor Response Remediation Advice Conclusion The advisory for this issue can be found here. The CVE for this issue is CVE-2022-26352. The advisory from dotCMS can be found here. This security research was performed by Hussein Daher...