With the rise of AI assistance features in an increasing number of products, we
have begun to focus some of our research efforts on refining our internal
detection and testing guidelines for LLMs by taking a brief look at the new AI
integrations we discover.
Alongside the rise of applications with LLM integrations, an increasing number
of customers come to ERNW to specifically assess AI applications. Our colleagues
Florian Grunow and
Hannes Mohr analyzed the novel attack
vectors that emerged and presented the results at
TROOPERS24 already.
Important note: Some media coverage on this topic falsely or inaccurately
depicts the attack conditions. To be clear: Any vulnerable device can be
compromised if the attacker is in Bluetooth range. That is the only
precondition.
During our research on Bluetooth headphones and earbuds, we identified several
vulnerabilities in devices that incorporate Airoha Systems on a Chip (SoCs). In
this blog post, we briefly want to describe the vulnerabilities, point out their
impact and provide some context to currently running patch delivery processes as
described at this year’s
TROOPERS Conference.
The X11 Window System has been used since September 1987 for Unix desktop
systems, allowing applications to display their windows. Today, one of the
server implementations of the protocol is the X.Org X server and XWayland, which
both use the same codebase. While reviewing the X server, several legacy
security issues were identified. These appear to originate from earlier design
stages when security considerations were less prominent. Despite the project’s
maturity and widespread use, some of these issues have persisted.
In a recent customer project, we discovered vulnerabilities in Microsoft
Bookings, an online appointment scheduling tool integrated into Microsoft 365,
allowing companies to have customers book meetings in available times
themselves. The findings originate from insufficient input validation on the
public meeting scheduling endpoint. Although Microsoft has largely mitigated
this vulnerability, our analysis provides important insights into potential
risks and areas for improvement.
Introduction & Context
Microsoft Bookings is a service that allows organizations to manage appointments
and meetings via a web interface. With integration to services such as Microsoft
Teams, the security of the booking process is critical. This blog post outlines
our technical analysis of the vulnerability, including proof-of-concept details
and an overview of the vendor response.
During a red-teaming-style customer project, we managed to get access to an
Rundeck API token. Rundeck is a job scheduler and
runbook automation platform designed to automate routine IT tasks across
multiple systems. At first, we were excited about this API token because if we
could create new Rundeck jobs, we could execute arbitrary code on the Rundeck
nodes and move laterally from there. However, it turned out that with this token
we only had permissions to run existing jobs.
We recently conducted a security assessment of VMware Carbon Black Cloud, a
unified SaaS solution that integrates endpoint detection and response (EDR),
anti-virus, and vulnerability management capabilities. As part of our
evaluation, we tested the solution’s ability to detect and prevent malicious
activity on Windows and Linux systems. Our analysis focused on the Carbon Black
agents for these platforms, and although we did not identify any critical
vulnerabilities, we want to share some of the findings in this blog post.
While conducting security research, I identified a critical vulnerability in Kemp’s LoadMaster Load Balancer. This vulnerability is a Command Injection and allows full system compromise. It requires no authentication and can be exploited remotely by having access to the Web User Interface (WUI). Kemp found that all LoadMaster versions up to and including version 7.2.60.0 and also the multi-tenant hypervisors up to and including version 7.1.35.11 are affected.
Kemp LoadMaster is a widely used Load Balancing Application that can commonly be seen in customer engagements. Therefore, we decided to take a closer look as part of our regular research projects.
During my Bachelor’s thesis, I identified several XSS vulnerabilities and a PHP Code Execution vulnerability via an insecure file upload in the learning management system (LMS) ILIAS. The XSS vulnerability can be chained with the code execution vulnerability so that attackers with tutor privileges in at least one course can perform this exploit chain.
The Bachelor’s thesis was motivated by the ever-increasing number of compromised universities in Germany1^(,)2^(,)3^(,)4^(,)5. The thesis analyzed the importance of LMS systems in that context, as those services are often exposed to the internet.
I was writing some challenges for PacketWars at
TROOPERS22. One was intended to be a JWT key confusion
challenge where the public key from an RSA JWT should be recovered and used to
sign a symmetric JWT. For that, I was searching for a library vulnerable to JWT
key confusion by default and found lua-resty-jwt. The original repository by
SkyLothar is not maintained and different from the library that is installed
with the LuaRocks package manager. The investigated library is a
fork of the original repository,
maintained by cdbattags in version 0.2.3 and was downloaded more than
4.8 million times
according to LuaRocks.
Recently, I discovered a sandbox breakout in the Groovy Sandbox used by the Jenkins script-security Plugin in their Pipeline Plugin for build scripts. We responsibly disclosed this vulnerability and in the current version of Jenkins it has been fixed and the according Jenkins Security Advisory 2019-09-12 has been published. In this blogpost I want to report a bit on the technical details of the vulnerability.
Description
The groovy sandbox transforms some AST nodes of the script to add security checks. For example