Headline

CVE-2020-5849: Sysdream, Le lab'

Unraid 6.8.0 allows authentication bypass.

4 years ago

#sql #xss #csrf #vulnerability #web #red_hat #git #java

Le laboratoire Sysdream

Le laboratoire de Sysdream concentre les activités de Recherche et Développement en sécurité informatique, dans lesquelles interviennent nos consultants. Ceux-ci travaillent sur des problématiques fortes, inspirées de notre expérience terrain et de nos observations, afin d’apporter leurs compétences au service de l’innovation technique et de la sécurité informatique en général.

La recherche effectuée au sein de notre laboratoire cible tout particulièrement l’identification de vulnérabilités, mais aussi l’étude des différentes solutions aux problèmes d’actualités, comme la sécurité des terminaux mobiles ou encore l’évolution des technologies du Web (de par leurs contraintes fortes dans la protection des données confidentielles et privées). Ces recherches que nous menons aboutissent dans certains cas à la mise en conformité des solutions en production, ainsi qu’à la publication de livres blancs explicitant la ou les problématiques et les solutions identifiées. Nos recherches sont aussi exposées dans les magazines (Hackin9, MISC, …) ou lors d’événements spécialisés comme le SSTIC, Hack in paris, ou encore la Nuit du hack.

Nous espérons ainsi pouvoir mettre à la disposition de tout un chacun les outils, études et analyses menées au sein de notre laboratoire et d’assurer une veille permanente dans le domaine de la sécurité.

14 Dec 2020

[CVE-2020-16842] CSRF protection bypass in iTop

iTop (ITSM & CMDB) is a complete open source, ITIL, web based service management tool including a fully customizable CMDB, a helpdesk system and a document management tool. It is developed by Combodo and hosted on GitHub

We found a bypass to the CSRF function, which could be used to create a new administrator account or execute code remotely through a variation of the CVE-2018-10642 vulnerability (when an administrator account is targeted).

21 Sep 2020

[CVE-2020-24389] Remote Code Execution on Drag and Drop Multiple File Upload – Contact Form 7

Drag and Drop Multiple File Uploader is a simple, straightforward WordPress plugin extension for Contact Form7, which allows the user to upload multiple files using the drag-and-drop feature or the common browse-file of your webform.

We discovered a remote code execution vulnerability in this plugin, because the validation of dangerous file extensions fails.

12 Aug 2020

[CVE-2020-17364] USVN stored XSS

User-Friendly USVN is a web interface written in PHP used to configure Subversion repositories.

We found a stored XSS vulnerability inside the commit module, that could allow an attacker to execute JavaScript into the client application and take over user web browsers.

12 Aug 2020

[CVE-2020-17363] USVN Remote code execution

User-Friendly USVN is a web interface written in PHP used to configure Subversion repositories.

We could execute code remotely, through an OS command injection inside the Timeline module. It can be used by an authenticated user to execute arbitrary command against the operating system.

05 Aug 2020

[CVE-2020-9036] Jeedom XSS leading to Remote Code Execution

Jeedom is a home automation solution used in IoT.

We discovered an XSS (cross-site-scripting) injection that can lead to a remote code execution.

09 Jun 2020

[CVE-2020-13404] Remote system command injection in Atos-Magento module

A system command injection vulnerability has been introduced in the Atos-Magento module version 3.0.0. This module manage the remote ATOS payment solution for Magento 1.x (1.7+) e-commerce websites.

25 May 2020

Abusing PackageKit on Fedora/CentOS for fun & profit (from wheel to root).

This article describes an exploitation path of PackageKit settings in Fedora/CentOS, to achieve local privilege escalation to root without any user interaction.

The scenario uses vulnerabilities in both the default configuration of PackageKit and some packages.

25 May 2020

[CVE-2020-10936] SYMPA Privileges escalation to root

We found a way to escalate our privileges to root, exploiting a vulnerability in the way that a setsuid binary can be abused to load malicious Perl libraries.

25 May 2020

[CVE-2020-12050] Fedora/Red Hat/CentOS local privilege escalation through a race condition in the sqliteODBC installer script

A vulnerability has been introduced in the package that installs sqliteODBC in Red Hat / CentOS / Fedora distributions.

It is a race condition that allows local users to escalate their privileges to root permissions.

22 May 2020

Ligolo : Reverse Tunneling made easy for pentesters, by pentesters

Ligolo is a simple and lightweight tool for establishing SOCKS5 or TCP tunnels from a reverse connection in complete safety (TLS certificate with elliptical curve).

It is comparable to Meterpreter with Autoroute + Socks4a, but more stable and faster.