Recent content on dead && end
Introduction I recently identified multiple vulnerabilities in TCPDF, which is a popular library used for PDF generation (this is a repost from the NCC Group research blog). These issues were addressed in version 6.8.0 of the library. Web applications and web services often utilize PDF generation libraries when generating PDFs based on user input in order to generate invoice documents or report…
While testing a Java-based web application, I came across a straightforward reflected cross-site scripting (XSS) vulnerability on the application’s login page, but the web application utilized a popular web application firewall (WAF), so it initially appeared that only HTML injection was feasible until I could identify a rule bypass. By combining the following basic techniques together I was…
After passing thru a number of hurdles, I put together a whitepaper documenting vulnerabilities that I found in the operating system and various security risks of the platform. The whitepaper was originally posted on the NCC Group research page (this is just another repost). There are a couple interesting bugs documented in the paper including details on how I chained together a HTML injection…
I found multiple HTML injection vulnerabilities in several KaiOS mobile applications that are pre-installed on KaiOS mobile devices (this is just a repost of the original found on the NCC Group research page). While exploiting a HTML injection vulnerability in a Firefox OS, or KaiOS, application normally has limited impact besides the ability to manipulate the applicaiton's user interface, I also…
NCC Group’s internal conference for 2020 contained another capture the flag that had plenty of interesting challenges. Mad props to Gabe, Dan, and Clayton for running another smooth CTF. Like the previous year the CTF consisted of a handful of servers that participants had to break into in order to acquire enumeration, foothold, and root flags (plus random cryptography and forensic flags).…
I found a number of vulnerabilities in the Alcatel Flip 2 KaiOS-based mobile device (this is just a repost of the original found on the NCC Group research page). The magickey PIN bypass is probably my favorite since it is a cute bug, but the ability to reconfigure OTA properties remotely via the browser is a bit more impactful. Alcatel Flip 2 Local Privilege Escalation (CVE-2019-16242) Alcatel…
NCC Group holds an internal security conference each year and the last con included a CTF that I participated in. Big props to Dan Helton for putting it together an enjoyable CTF that went smoothly. The CTF consisted of a handful of servers that participants had to break into in order to acquire enumeration, foothold, and root flags. Additionally, there were other challenges related to crypto and…
I wrote a short blog post describing a Burp Suite extension that I developed here. This is just a repost originally hosted on the NCC Group research page… Argument Injection Hammer is an extension for the intercepting proxy Burp Suite. I wrote the extension in order to enhance the ability of the proxy to detect argument injection and manipulation vulnerabilities in web applications. The…
When the Microcorruption game first came out I beat the first sixteen levels and then I got stumped on the alphanumeric MSP430 shellcode level (damn MSP430 instructions). I started to go through the game again to beat more levels and take notes to reenforce my own knowledge of the subject. I suggest everyone check out the game first if you’re interested in learning about different…
I disclosed multiple vulnerabilities to Dialogic in their PowerMedia XMS product (version 3.4), which is a “highly scalable, software-only media server that enables standards-based, real- time multimedia communications solutions for IMS, MRF, Enterprise, and WebRTC applications on premise or in the cloud.” CVE-2018-11634 - Plaintext storage of passwords in a SQLite database.…
Maxthon Browser is another popular Android browser that is used instead of the stock browser. I have identified a number of interesting, and severe, vulnerabilities in the Android version of the browser that could result in remote code execution and information leakage. Exposed JavaScript Interface allows for arbitrary file writes - A malicious webpage can force the browser to download a zip file,…
React Native is another cross-platform mobile development framework created by Facebook that developers can use to develop mobile applications on the Android and iOS platforms using JavaScript. From an architectural standpoint the framework is closer to Titanium or Kony than Cordova given that the mobile application uses JavaScriptCore as a standalone JS engine to execute the JS application code…
A recent internal thread about detecting hooking frameworks in native code (C/C++) got me thinking about the different ways that a Java Android application can detect the presence of either Cydia Substrate or the Xposed framework. Disclaimer: All of these anti-hooking techniques are easy to bypass by any experienced reverse engineer. I’m just exploring how one might go about detecting that…
As part of my research into the Intent.parseUri function, I identified that the Android version of the Puffin Browser was vulnerable to remote code execution, on 4.4.3 devices and below, and remote file disclosure, on any device, due to a number of factors including improper intent URI scheme parsing. The parseUri function is often used by Android browsers, or Android applications with WebView…
The ChildBrowser plug-in is a popular third-party plug-in that allows displaying untrusted external websites within a Cordova-based application. It is very similar to the core InAppBrowser plug-in, which is the plug-in that Apache currently recommends using, since they both create a separate WebView instance that does not expose native mobile APIs to the untrusted HTML/JavaScript. Last year I…
There exists a number of third-party browsers in use on Android devices besides the stock browser and Chrome. PhoneArena provided a feature comparison and performance comparison of the “best” Android browsers in 2014 , but I wasn’t familiar with a number of the browsers on the list so decided to take a look at the security of a few of them. The first one that I looked at named…
The Cordova mobile application development framework does not support launching a mobile application via a custom URI scheme, such as someurischeme://pathhere/?param=somedata, out of the box on all of its supported platforms, which is somewhat surprising for a cross-platform mobile framework. Notably missing is support for custom URI schemes in the Android version of the framework, although custom…
I noticed a couple somewhat interesting vulnerabilities earlier this year that require the use of cross-origin resource sharing to exploit. Consider the following JavaScript code and assume that the getQueryString function returns the value of the “someUrl” parameter in the query string by parsing the document.location object. In the vulnerable page, the web application asks the user…
A colleague asked me about an Android vulnerability called fragment injection because of an article he read [1] and I think its worth diving into the details of the vulnerability. Fragment injection is a classic example of using reflection in an unsafe way (CWE-470) [2]. As in untrusted data from an Intent is used to determine which class is instantiated within the target Android application. In…
Earlier this year, I identified an interesting vulnerability (CVE-2014-0073) in one of Apache Cordova’s core plug-ins (InAppBrowser). Cordova, also sometimes referred to as PhoneGap, is a popular cross-platform mobile framework that allows developers to write mobile applications in JavaScript and HTML. The JavaScript and HTML code executes within the Cordova WebView and has access to native…
A cross-domain policy file grants a web client such as a Flash application or a Siverlight application the ability to make a cross-domain request and access the response. As in it allows a Flash application on www.evil.com to make a HTTP request to www.bank.com and read the HTTP response, which may allow an attacker to acquire sensitive information (account information, sensitive messages, CSRF…
Android applications often use the WebView class to embed a browser component within an Activity in order to display online content. For example, the following code will show the Google homepage within an Activity. WebView webView = new WebView (R.id.webView1); webView.getSettings().setJavaScriptEnabled(true); webView.loadUrl('http://www.google.com'); An application can inject Java objects into a…
Assuming an attacker can control the start of a CSV file served up by a web application, what damage could be done? The example PHP code below serves up a basic CSV file, but allows the user to control the column names. Note that the Content-Type header is at least set properly. <?php header('Content-Type: text/csv'); header('Content-Disposition: inline; filename=blah.csv');…
I suppose I should explain what Adobe refers to as a security control bypass (CVE-2011-2429). There exists a number of different security sandboxes that the Flash Player uses to restrict SWFs. In this case, I was able to create a SWF that bypassed the restrictions imposed by a local-with-filesystem sandbox. “The local-with-filesystem sandbox–For security purposes, Flash Player places…
Searching for “how to prevent cross site scripting in .NET” in Google produces a number of interesting results. The first link points to a MSDN article titled How To: Prevent Cross-Site Scripting in ASP.NET, but this article includes the following code snippet, which “uses HtmlEncode to ensure the inserted text is safe”, but this code is clearly vulnerable upon further…
Attackers have commonly used the null character to bypass file extension restrictions during the exploitation of local file inclusion vulnerabilities. rain.forest.puppy outlined this type of attack against Perl-based CGI applications in Phrack issue 55 over ten years ago, but the problem has also affected web applications written in other higher-level languages such as Java, .NET, and PHP.…