Today’s CVE: CVE-2023-4863

Back in September 2023, a real-world attack took place using a vulnerability in the WebP Image Format.

This vulnerability was actively exploited in real attacks, and the ones who discovered it were:

Apple Security Engineering

Citizen Lab


Impact?

The vulnerability affected major and popular browsers and apps like:

Google Chrome

Firefox

Microsoft Edge

Adobe


Basically, anything using the libwebp library was vulnerable.


---

The Attack: Heap Buffer Overflow → RCE

The vulnerability is a Heap Buffer Overflow, but it gets worse — attackers were able to escalate this into Remote Code Execution (RCE).


---

So Spider, what makes this vuln different from any other one?

Well, this one was used in major malware/spyware tools like:

Spyware

Predator

And yes, even Pegasus



---

How did it work?

All the attacker had to do was get the victim to open a malicious WebP image — either by downloading it or visiting a site with the image embedded.
Once loaded, the attack would be triggered and could lead to full device compromise.


---

Here’s a simple PoC to show how it works:

# generate_malicious_webp.py
with open("malicious.webp", "wb") as f:
f.write(b"RIFF")
f.write(b"\x00\x00\x00\x00") # fake size
f.write(b"WEBPVP8X")
f.write(b"A" * 1000000) # overflow buffer

To test this PoC, use Chrome version < 116


---

How to stay safe?

1. Update your browser to the latest version


2. Don’t click on shady or unknown links


3. Check your libwebp version, and update it if it’s outdated

عشان يكون مفيش ملل اي الغلطه الي انا عملتها 😔

*بورت سويجر لاب sql part 1*


*Port Swiger Lab SQL Part 1*

So that it’s not boring, what mistake did I make? 😔

Sqli part 2