Intro This is the backstory to CVE-2024-43488 , which disclosed an RCE vulnerability in vscode-arduino . vscode-arduino was a VSCode extension that added Arduino support. It was developed by Microsoft and had over 2 million installs. I found and reported this vulnerability 1-2 years ago. The extension was deprecated shortly after reporting. Extension design Users interact with extension UI , which…
We’re often advised not to click untrusted links, but less often told why. This post will outline a few things that can go wrong when you simply click a link. In brief, clicking a link can lead to exploitation of vulnerabilities in your environment. These vulnerabilities can be in your apps, computer, local network, web browser, or even in your psyche. Web app vulnerabilities A link click…
Here is a bug I reported to LastPass, copied below with some edits. They shipped a fix within 4 business days and paid out a $1k bounty. One takeaway is the need for defense-in-depth. While our development standards may prohibit sensitive tokens in URLs, it can still happen due to human error. We can mitigate this by adding a strict Referrer Policy like <meta name="referrer" content="no-referrer">…
This tweet describes an interesting behavior: certain non-ASCII characters map to ASCII characters when converted to upper- or lower-case. Specifically: ı (\u0131) to upper-case --> I ſ (\u017f) to upper-case --> S İ (\u0130) to lower-case --> i K (\u212a) to lower-case --> k This can help bypass XSS filters and blacklists. For example, the filter in the app below can be bypassed by ?name=<ſcript…
Suppose you’re at the latest hip coffee shop in town, enjoying their comfy chairs and high-speed wifi. You’re doing some confidential work using a relatively secure web application. The application always uses TLS, redirects HTTP requests back to HTTPS, and deploys Double Submit Cookies (with the ‘secure’ cookie flag) to protect from CSRF. Now suppose that the coffee shop staff becomes part of…
This post is about how I learned of JSONP as an attack vector. This isn’t a new vulnerability, but it’s just nice that I discovered it on my own. A note on Same-Origin Policy Same-Origin Policy (SOP) prevents a webpage from reading data on a different domain. So if you open a tab with hacker.com, your browser won’t let it read data on bank.com. There are notable exceptions, like…
CSRF is a prevalent and well-known vulnerability that affects web applications. The common way to protect against CSRF is to require anti-CSRF tokens on state-modifying requests. For defense in depth, you can add an extra layer of security by additionally requiring custom headers. This can mitigate scenarios where anti-CSRF tokens are somehow leaked (something I have seen happen). Simple vs…
I know you’ve been waiting eagerly, but it’s finally here: my own personal blog! … Just kidding, I can hear the crickets chirping. This is intended to be an informal space for me to write about topics of interest. Mostly technical posts about what I’m learning in “cyber” security (to use the current vernacular). Perhaps other topics as well. If future…