Google SSO misconfiguration leading to Account Takeover

I’m a technical guy. However, this post doesn’t contain any technical details, but that’s because this bug doesn’t require any.  I need to…Continue reading on Medium »
Read more...

Google SSO misconfiguration leading to Account Takeover
https://0x4kd.medium.com/google-sso-misconfiguration-leading-to-account-takeover-cf9bcf63e76e?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

I’m a technical guy. However, this post doesn’t contain any technical details, but that’s because this bug doesn’t require any. 
I need to…Continue reading on Medium » (https://0x4kd.medium.com/google-sso-misconfiguration-leading-to-account-takeover-cf9bcf63e76e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
GitLab patches RCE bug in GitHub import function

GitLab patches RCE bug in GitHub import functionPost Views: 17 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes A vulnerability in GitLab allowed attackers to stage various attacks against GitLab servers, including the cloud-hosted GitLab.com platform.The bug, reported by security researcher ‘yvvdwf’, was caused by the way GitLab imports data from GitHub, which could be exploited to run commands on the host server. Unsafe importsGitLab uses Octokit, a library that provides an interface to import data from the GitHub API. To retrieve and present its results, Octokit uses the HTTP client library Sawyer.

However, GitLab directly used the Sawyer results returned by Octokit without sanitizing them, which provided opportunities to insert malicious commands.

Yvvdwf found that one of the parameters used in the import function was prone to command injections against GitLab’s Redis database.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course RCE, information theft, and moreOn standalone GitLab installations, an attacker could exploit the command injection bug to escalate from Redis to Bash and send commands to the operating system. Any potential attacker would have remote code execution (RCE) access to the host with the privileges of the host process.

While the RCE exploit did not work on GitLab.com, yvvdwf was able to use other Redis commands to replicate data from GitLab.com to a standalone server with a public IP. They were also able to poison GitLab projects through the same mechanism and make them inaccessible.

An attacker with a standalone GitLab installation and an API access token could use the exploit to steal information, inject malicious code, and perform other malicious actions against GitLab.com.
Trending: A primer on OS Command Injection Attacks
Trending: OSINT Tool: ProtOSINT Protecting GitLab serversThe vulnerability was assigned CVE-2022-2884 with a critical base score of 9.9 in the Common Vulnerability Scoring System.

GitLab has already patched the issue in GitLab.com and published a critical security release for GitLab Community Edition and Enterprise Edition.

All users are advised to upgrade their GitLab installation. For organizations that can’t upgrade right away, GitLab advises them to secure their installation by disabling imports until they can patch their system.

While GitLab users will be safe by using the cloud or updated self-hosted version of the platform, other services that use Octakit to interact with GitHub should be wary and make sure that they perform the right checks around the data they pass on and receive through the library.

​
Trending: Microsoft SQL servers hacked with FARGO ransomware attacks Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-5-300x150.png New npm timing attack could lead to supply chain attacksOctober 13, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-4-300x150.png Critical RCE Vulnerability Found in vm2 Sandbox LibraryOctober 12, 2022[...]

Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-3-300x150.png Zimbra remote code execution vulnerability actively exploited in the wildOctober 11, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-2-1-300x150.png Intel confirms leaked Alder Lake BIOS Source Code is authenticOctober 10, 2022
Reading Time: 3 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post GitLab patches RCE bug in GitHub import function first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

PoC Exploit Released for Critical Fortinet Auth Bypass Bug Under?

A proof-of-concept (PoC) exploit code has been made available for the recently disclosed critical security flaw affecting Fortinet FortiOS…Continue reading on Medium »
Read more...

hacking: security in practice
FortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass Technical Deep Dive (CVE-2022-40684)

https://external-preview.redd.it/pOrwqOKKFnGcTN305sQA5fbJ1gdxEvgsV9O_mKTYNw4.jpg?width=640&crop=smart&auto=webp&s=30a2c94b0e21f8454ed3e3f3ad8414b5d7508e9d submitted by /u/CyberMasterV
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Jquery intrinsic vulnerability?

Good morning hackers, i really need to understand a “vulnerability” i found in a portswigger DOM based XSS which i’m finding hard to understand. I got to the basics with a bit of debugging and found that calling with jquery: $(“x ”) Will execute the alert so i thought..mmh maybe the jquery selector somehow “renders” the html. I tryed with a lot of other tag: svg,script ecc. and even other tag that don’t require to close (since jquery selector seems to slice it) like with: $(“”) But nothing works… it only works with images. Any idea why?

submitted by /u/Bongioo
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Password-protect your files on PC

https://cdn-images-1.medium.com/max/1165/1*pe56cuW825JxfeF5nP6Gtg.jpeg
For most people, adding a password to their files offers sufficient protection.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Some resources for women breaking into cybersecurity

https://cdn-images-1.medium.com/max/669/1*mflSA9phHv_OeoE6_BUOBA.jpeg
Here are some resources for women breaking into cybersecurity.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Budworm Hackers Resurface with New Espionage Attacks Aimed at?!?

https://cdn-images-1.medium.com/max/728/0*VpiQsm_hpew-F4gV.jpg
An advanced persistent threat (APT) actor known as Budworm targeted a U.S.-based entity for the first time in more than six years…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
BLUE PRINT -TryHackMe

https://cdn-images-1.medium.com/max/800/1*eKxDaTGXdElKiVBuhIvC_A.jpeg
Hack into this Windows machine and escalate your privileges to Administrator.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
CHSF Hospital Hack: What Happened, Our Analysis and Thoughts

https://cdn-images-1.medium.com/max/1400/1*Av1Ma-KQ0sOxksrYHGXiDg.jpeg
Intro

Continue reading on CloudMosa »

___________________________
@hacking_Attack
@Hacking_Video