Node.js 模块 node-serialize 反序列化任意代码执行漏洞

原文链接：Exploiting Node.js deserialization bug for Remote Code Execution 有增改 原作者：Ajin Abraham 译：Holic 知道创宇404安全实验室 tl;dr 若不可信的数据传入 unserialize 函数，通过传递立即调用函数表达式（IIFE）的 JavaScript 对象可以实现任意代码执行。 漏洞详情 审计 Node.js 代码时，我正好看到一个名为 node-serialize 的序列号/反序列化模块。下面是一段代码示例，来自网络请求的 cookie 会传递到该模块的 unserialize 函数中。...

CVE-2017-5593

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Psi+ 0.16.563.580 -...

LocalTapiola: High server resource usage on captcha (viestinta.lahitapiola.fi)

Basic report information Summary: It is possible to generate a simple request which creates a high cpu/bandwidth consumption from the server by abusing the captcha servlet Description: By sending a specially crafted request and changing the height/width parameters in the captcha form it is possib...

shopify-scripts: SIGSEGV - mrb_vm_exec - line:1312

PoC ------------------- The following code triggers the bug attached as mrbvmexec.rb: n s s k h GC.start ObjectSpace.eachobject|obj|obj Debug - mirb ------------------- gdb r mrbvmexec.rb The program being debugged has been started already. Start it from the beginning? y or n y Starting program:...

CVE-2016-10087

The pngsettext2 function in libpng 0.71 before 1.0.67, 1.2.x before 1.2.57, 1.4.x before 1.4.20, 1.5.x before 1.5.28, and 1.6.x before 1.6.27 allows context-dependent attackers to cause a NULL pointer dereference vectors involving loading a text chunk into a png structure, removing the text, and...

HelpDeskZ 1.0.2 - (Authenticated) SQL Injection Unauthorized File Download

HelpDeskZ 1.0.2 - Authenticated SQL Injection Unauthorized File Download ''' Exploit Title: HelpDeskZ fetchRow"SELECT , COUNTid AS total FROM ".TABLEPREFIX."attachments WHERE id=".$db-realescapestring$params2." AND ticketid=".$params0." AND msgid=".$params3; third argument AND msgid=".$params3;...

SUSE-SU-2017:0279-1 Security update for systemd

This update for systemd fixes the following issues: This security issue was fixed: - CVE-2016-10156: Fix permissions set on permanent timer timestamp files, preventing local unprivileged users from escalating privileges bsc1020601. These non-security issues were fixed: - Fix permission set on...

Internet Bug Bounty: Out of bounds memory read in unserialize()

I have found and reported an out of bounds memory read in PHP: https://bugs.php.net/bug.php?id=73825 It affected all three supported versions and has been fixed with the latest updates: https://secure.php.net/ChangeLog-5.php5.6.30 https://secure.php.net/ChangeLog-7.php7.0.15...

libarchive: Heap-buffer-overflow in detect_form

Project: https://github.com/libarchive/libarchive.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=4619748121772032 Project: libarchive Fuzzer: libFuzzerlibarchivefuzzer Fuzz target binary: libarchivefuzzer Job Type: libfuzzerasanlibarchive Platform Id: linux Crash Type:...

shegame.com XSS vulnerability

Open Bug Bounty ID: OBB-206770 Description| Value ---|--- Affected Website:| shegame.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

UBUNTU-CVE-2016-8745

A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn...

CVE-2016-6772

CVE-2016-6772 is an Android Wi‑Fi elevation of privilege vulnerability. The issue could let a local malicious app execute code in the context of a privileged Wi‑Fi process. Affected products/versions per the entry: Android 5.0.2, 5.1.1, 6.0, 6.0.1, and 7.0. The root cause is exploitation of the W...

Slack: dom xss in https://www.slackatwork.com

https://www.slackatwork.com/wp-content/themes/twentyfifteen/genericons//example.html1...

ua9qcq.com XSS vulnerability

Vulnerable URL: http://ua9qcq.com/en/results.php?lang=en.=143yr=2016mo=0'"--!...

gnutls: Heap-buffer-overflow in read_attribute

Project: https://gitlab.com/gnutls/gnutls.git Detailed report: https://clusterfuzz-external.appspot.com/testcase?key=6667435805507584 Project: gnutls Fuzzer: libFuzzergnutlsopenpgpcertparserfuzzer Fuzz target binary: gnutlsopenpgpcertparserfuzzer Job Type: libfuzzerasangnutls Platform Id: linux...

shopify-scripts: Integer Overflow in mrb_ary_set

Hi, I found a crash in mruby. I frankly couldn't reproduce it in mruby-engine. I think it is because of memory limitation, but I'm not sure. Here is a PoC when the size of MRBINT is 32. ruby ary = Array.new0 ary0x7fffffff = 1 $ gdb -q --args ./bin/mruby ./test.rb Reading symbols from...

Ubuntu’s Crash Report Tool Allows Remote Code Execution

No software is immune to being Hacked! Not even Linux. A security researcher has discovered a critical vulnerability in Ubuntu Linux operating system that would allow an attacker to remotely compromise a target computer using a malicious file. The vulnerability affects all default Ubuntu Linux...

Internet Bug Bounty: Invalid parameter in memcpy function trough openssl_pbkdf2

Upstream: https://bugs.php.net/bug.php?id=72776 Summary: ------------ When keylength parameter is greater than 0x7fffffff, size parameter is interpreted as negative in memcpy, inside PKCS5PBKDF2HMAC function libcrypto.so. This issue happens only in PHP 5.6 branch. PHP 7.0 avoids this issue trough...

Code injection

The GPS component in Android before 2016-12-05 allows man-in-the-middle attackers to cause a denial of service GPS signal-acquisition delay via an incorrect xtra.bin or xtra2.bin file on a spoofed Qualcomm gpsonextra.net or izatcloud.net host, aka internal bug 31470303 and external bug 211602 and...

Android system_server Code Loading Bypass Vulnerability

Exploit for Android platform in category local exploits Android: Code loading bypasses in systemserver As of Android Nougat, a new set of SELinux rules have been added which are designed to prevent systemserver from loading arbitrary code into its address-space. This has been enforced by adding t...