How I Discovered Over 40+ Impactful Vulnerabilities Within 1 Hour, Just for Fun!
https://infosecwriteups.com/how-i-discovered-over-40-impactful-vulnerabilities-within-1-hour-just-for-fun-a26eeaa75461?source=rss------bug_bounty-5
https://infosecwriteups.com/how-i-discovered-over-40-impactful-vulnerabilities-within-1-hour-just-for-fun-a26eeaa75461?source=rss------bug_bounty-5
Hello, I’m Takshal, aka tojojo. I hope you all are doing well. Today, I’m excited to share my journey of finding more than 40+ impactful…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/how-i-discovered-over-40-impactful-vulnerabilities-within-1-hour-just-for-fun-a26eeaa75461?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Python 101 for Hackers by Riley Kidd | TCM Security
https://cdn-images-1.medium.com/max/875/0*4lk8LOhWdG1QO3Lm
Quick Disclaimer:-
I) I do not receive any kind of compensation from anyone or any organization for sharing my experience in his blog.
— -
Continue reading on Medium »
Python 101 for Hackers by Riley Kidd | TCM Security
https://cdn-images-1.medium.com/max/875/0*4lk8LOhWdG1QO3Lm
Quick Disclaimer:-
I) I do not receive any kind of compensation from anyone or any organization for sharing my experience in his blog.
— -
Continue reading on Medium »
Improper Neutralization of Input During Web Page Generation, Stored XSS in KiwiTCMS…
Hi everyone 👋🏻, Today I would like to share a vulnerability I found in KiwiTCMS. also my first CVE (CVE-2023–36809)Continue reading on Medium »
Read more...
Hi everyone 👋🏻, Today I would like to share a vulnerability I found in KiwiTCMS. also my first CVE (CVE-2023–36809)Continue reading on Medium »
Read more...
Medium
Improper Neutralization of Input During Web Page Generation, Stored XSS in KiwiTCMS…
Hi everyone 👋🏻, Today I would like to share a vulnerability I found in KiwiTCMS. also my first CVE (CVE-2023–36809)
Improper Neutralization of Input During Web Page Generation, Stored XSS in KiwiTCMS…
https://medium.com/@mahshooq/improper-neutralization-of-input-during-web-page-generation-stored-xss-in-kiwitcms-6d798f74d71?source=rss------bug_bounty-5
https://medium.com/@mahshooq/improper-neutralization-of-input-during-web-page-generation-stored-xss-in-kiwitcms-6d798f74d71?source=rss------bug_bounty-5
Hi everyone 👋🏻, Today I would like to share a vulnerability I found in KiwiTCMS. also my first CVE (CVE-2023–36809)Continue reading on Medium » (https://medium.com/@mahshooq/improper-neutralization-of-input-during-web-page-generation-stored-xss-in-kiwitcms-6d798f74d71?source=rss------bug_bounty-5)
Inside the XSS Vulnerability: How to Understand and Protect Yourself
Cross-Site Scripting (XSS) is one of the most prevalent and dangerous vulnerabilities in web applications. It allows attackers to inject…Continue reading on InfoSec Write-ups »
Read more...
Cross-Site Scripting (XSS) is one of the most prevalent and dangerous vulnerabilities in web applications. It allows attackers to inject…Continue reading on InfoSec Write-ups »
Read more...
Medium
Inside the XSS Vulnerability: How to Understand and Protect Yourself
Cross-Site Scripting (XSS) is one of the most prevalent and dangerous vulnerabilities in web applications. It allows attackers to inject…
CVE-2023–38646 — Metabase Pre-Auth RCE
CVE-2023–38646 — Metabase Pre-Auth RCESummary Metabase, a widely-used business intelligence platform that lets users explore and learn from their data, that had a critical security flaw in versions before 0.46.6.1 (open source) and 1.46.6.1 (Enterprise). This vulnerability, designated as CVE-2023–38646, allowed attackers to execute arbitrary commands on the server without requiring any authentication. The impact of this flaw was severe, as it granted unauthorized access to the server at the server’s privilege level. The exploit was fixed in the subsequent versions 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.Shodan search for MetabaseTechnical Severity The vulnerability existed in the /api/setup/validate API endpoint, which served as a crucial part of Metabase’s initial setup process. During application setup, this endpoint was responsible for checking the database connection. However, attackers could exploit a flaw in the JDBC connection handling, leading to remote code execution (RCE) with pre-authentication. This meant that attackers could execute malicious commands on the server with elevated privileges, gaining full control over the application environment. With this level of access, an attacker could potentially steal sensitive data, manipulate the application, or even gain control of the entire server infrastructure.Reproducing the Exploit GitHub - shamo0/CVE-2023-38646-PoC: Metabase Pre-auth RCE To understand how the exploit works, let’s follow the steps provided in the PoC section of the GitHub repository’s README file.Retrieve Setup Token: Start by navigating to “http://vulnerablehost.com/api/session/properties" to obtain the “setup-token.”Setup Token showing from /api/session/properties 2. Set Up Collaborator: Next, get a collaborator URL, for example, using BurpSuite. This URL will be used to track the exploit’s callbacks. 3. Run the PoC Script: Use the provided PoC script “CVE-2023–38646.py” with the following parameters:-u: Target URL-t: Setup token-c: Collaborator URL Example: python3 CVE-2023-38646.py -u <target> -t <setup-token> -c <collaborator-url> 4. Check Collaborator for Callbacks: Monitor the collaborator URL for any potential callbacks triggered by the exploit. Successful callbacks indicate that the vulnerability has been exploited.Mitigation and Remediation The severity of this vulnerability underscores the importance of prompt action. Metabase users must upgrade to fixed versions (0.46.6.1, 1.46.6.1, or later) as soon as possible to eliminate the risk of exploitation. Immediate upgrading is the most effective approach to prevent unauthorized access and ensure data security. For cases where immediate upgrades are not feasible, blocking requests to the vulnerable /api/setup endpoints can provide temporary protection.Referenceshttps://github.com/shamo0/CVE-2023-38646-PoChttps://www.metabase.com/blog/security-advisoryhttps://blog.calif.io/p/reproducing-cve-2023-38646-metabasehttps://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/ CVE-2023–38646 — Metabase Pre-Auth RCE was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
CVE-2023–38646 — Metabase Pre-Auth RCESummary Metabase, a widely-used business intelligence platform that lets users explore and learn from their data, that had a critical security flaw in versions before 0.46.6.1 (open source) and 1.46.6.1 (Enterprise). This vulnerability, designated as CVE-2023–38646, allowed attackers to execute arbitrary commands on the server without requiring any authentication. The impact of this flaw was severe, as it granted unauthorized access to the server at the server’s privilege level. The exploit was fixed in the subsequent versions 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.Shodan search for MetabaseTechnical Severity The vulnerability existed in the /api/setup/validate API endpoint, which served as a crucial part of Metabase’s initial setup process. During application setup, this endpoint was responsible for checking the database connection. However, attackers could exploit a flaw in the JDBC connection handling, leading to remote code execution (RCE) with pre-authentication. This meant that attackers could execute malicious commands on the server with elevated privileges, gaining full control over the application environment. With this level of access, an attacker could potentially steal sensitive data, manipulate the application, or even gain control of the entire server infrastructure.Reproducing the Exploit GitHub - shamo0/CVE-2023-38646-PoC: Metabase Pre-auth RCE To understand how the exploit works, let’s follow the steps provided in the PoC section of the GitHub repository’s README file.Retrieve Setup Token: Start by navigating to “http://vulnerablehost.com/api/session/properties" to obtain the “setup-token.”Setup Token showing from /api/session/properties 2. Set Up Collaborator: Next, get a collaborator URL, for example, using BurpSuite. This URL will be used to track the exploit’s callbacks. 3. Run the PoC Script: Use the provided PoC script “CVE-2023–38646.py” with the following parameters:-u: Target URL-t: Setup token-c: Collaborator URL Example: python3 CVE-2023-38646.py -u <target> -t <setup-token> -c <collaborator-url> 4. Check Collaborator for Callbacks: Monitor the collaborator URL for any potential callbacks triggered by the exploit. Successful callbacks indicate that the vulnerability has been exploited.Mitigation and Remediation The severity of this vulnerability underscores the importance of prompt action. Metabase users must upgrade to fixed versions (0.46.6.1, 1.46.6.1, or later) as soon as possible to eliminate the risk of exploitation. Immediate upgrading is the most effective approach to prevent unauthorized access and ensure data security. For cases where immediate upgrades are not feasible, blocking requests to the vulnerable /api/setup endpoints can provide temporary protection.Referenceshttps://github.com/shamo0/CVE-2023-38646-PoChttps://www.metabase.com/blog/security-advisoryhttps://blog.calif.io/p/reproducing-cve-2023-38646-metabasehttps://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/ CVE-2023–38646 — Metabase Pre-Auth RCE was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
CTF { Cyborg }
Not much information about the machine, so we get right into it.
Continue reading on Medium »
CTF { Cyborg }
Not much information about the machine, so we get right into it.
Continue reading on Medium »