Research

CloudSec Tidbits is a blogpost series showcasing interesting bugs found by Doyensec during cloud security testing activities. Each blogpost will discuss a specific vulnerability resulting from an insecure combination of web and cloud related technologies. Every article will include an Infrastructure as Code (IaC) laboratory that can be easily deployed to experiment with the described vulnerability.

- Episode 2 (post): https://blog.doyensec.com/2023/01/24/tampering-unrestricted-user-attributes-aws-cognito.html
- Episode 2 (code): https://github.com/doyensec/cloudsec-tidbits/tree/main/lab-cognito

In this blog post, Doyensec's researcher Mohamed Ouad explores the Apache JServ Protocol version 1.3, and the infamous Ghostcat (CVE-2020-1938) vulnerability.

https://blog.doyensec.com/2022/11/15/learning-ajp.html

In this blog post, we explore how to exploit CVE-2021-26437 (Visual Studio Code .ipynb Jupyter Notebook XSS) to achieve remote code execution in VScode. A detailed technical description of the issue, together with a set of exploitation techniques and the full exploit are provided given that the issue has been patched for over one year.

https://blog.doyensec.com/2022/10/27/jupytervscode.html

CloudSec Tidbits is a blogpost series showcasing interesting bugs found by Doyensec during cloud security testing activities. Each blogpost will discuss a specific vulnerability resulting from an insecure combination of web and cloud related technologies. Every article will include an Infrastructure as Code (IaC) laboratory that can be easily deployed to experiment with the described vulnerability.

- Episode 1 (post): https://blog.doyensec.com/2022/10/18/cloudsectidbit-dataimport.html
- Episode 1 (code): https://github.com/doyensec/cloudsec-tidbits/tree/main/lab-dataimport

There are many security solutions available today that rely on the Extended Berkeley Packet Filter (eBPF) features of the Linux kernel to monitor kernel functions. Nowadays, eBFP-based programs are used for DDoS mitigations, intrusion detection, container security, and general observability. We audited one particular implementation, but eventually extended our research to techniques that can be generally applied to other targets while attempting to bypass any security monitoring solution based on eBPF: https://blog.doyensec.com/2022/10/11/ebpf-bypass-security-monitoring.html

We've put R2c’s Semgrep in a head-to-head test with GitHub’s CodeQL. Here are our results: https://blog.doyensec.com/2022/10/06/semgrep-codeql.html

Learn how various Electron API permissions could allow apps to spy on their users and what developers can do to protect them.

Read the full details on our research blog post: https://blog.doyensec.com/2022/09/27/electron-api-default-permissions.html

This research focused on creating an all-around tool (named Confuser) to test and exploit potential Dependency Confusion vulnerabilities in the wild. The tool allows scanning packages.json files, generating and publishing payloads to the NPM repository, and finally aggregating the callbacks from vulnerable targets. To validate the effectiveness, we looked for potential Dependency Injection vulnerabilities in top ElectronJS applications.

Article: https://blog.doyensec.com/2022/07/21/dependency-confusion.html

Tool: https://github.com/doyensec/confuser

This article will help pentesters use their familiarity with classic database systems such as Postgres and MariaDB, and apply it to Apache Pinot. In this post, we will show how a classic SQL-injection (SQLi) bug in a Pinot-backed API can be escalated to Remote Code Execution (RCE) and then discuss post-exploitation.

Article: https://blog.doyensec.com/2022/06/09/apache-pinot-sqli-rce.html

This article introduces VirtualBox vulnerability research and explains how to build a coverage-based fuzzer, focusing on the emulated network device drivers. We provide all the necessary steps and code required to instrument and debug the latest stable version of VirtualBox.

Article: https://blog.doyensec.com/2022/04/26/vbox-fuzzing.html

Code: https://github.com/doyensec/vbox-fuzz

GraphQL is getting more popular every day. Despite that, it is not immune to Cross-Site Request Forgery attacks. We spent the last few weeks testing a variety of GraphQL frameworks and applications to understand how widespread this issue is.

Read the full story on our blog: https://blog.doyensec.com/2021/05/20/graphql-csrf.html

In this blog post, we’re releasing a new tool to analyse regular expressions and hunt for ReDoS vulnerabilities. Our heuristic has been proven to be extremely effective, as demonstrated by many vulnerabilities discovered across popular NPM, Python and Ruby dependencies.

Read the full story on our blog: https://blog.doyensec.com/2021/03/11/regexploit.html

ElectronJs is getting more secure every day. Context isolation and other security settings are planned to become enabled by default with the upcoming release of Electron 12 stable, seemingly ending the somewhat deserved reputation of a systemically insecure framework.

From an attacker’s perspective, Electron-specific APIs are very often the easiest path to gain remote code execution, read or write access to the host’s filesystem, or leak sensitive user’s data. Malicious JavaScript running in the renderer can often subvert the application using such primitives.

Read the full story on our blog: https://blog.doyensec.com/2021/02/16/electron-apis-misuse.html

Doyensec researched mobile P2P Wi-Fi protocols and their obscure file-sharing implementations. As a result, an overlooked problem common to every Android vendor-provided solution was identified.

Read the full story on our blog: https://blog.doyensec.com/2020/12/10/novel-abuses-wifi-direct-mobile-file-transfers.html

A new major release of InQL, our GraphQL security testing tool, is out! This release includes a Cycles Detector, Request Timer, Precise Query Generation and many bug fixes.

Read more on our blog: https://blog.doyensec.com/2020/11/19/inql-scanner-v3.html

As part of our fuzzing initiatives, we worked on a few techniques to target popular JavaScript engines (JSE). Our research resulted in a contribution to the well known fuzzer "Fuzzilli". By integrating Fuzzilli with JerryScript, Doyensec was able to identify multiple security vulnerabilities over the course of just four weeks.

Read more on our latest blog post: https://blog.doyensec.com/2020/09/09/fuzzilli-jerryscript.html

This blog post illustrates a vulnerability affecting the Play Framework that we discovered during a client engagement. This issue allows a complete Cross-Site Request Forgery (CSRF) protection bypass under specific configurations.

Read more on the blog: https://blog.doyensec.com/2020/08/20/playframework-csrf-bypass.html

A new version of InQL, our GraphQL security testing tool, is out! This release includes a new stand-alone UI, which integrates an embedded GraphiQL server and many other features.

Read more on the blog: https://blog.doyensec.com/2020/06/11/inql-scanner-v2.html

We are building a flexible ASN.1 grammar-based fuzzer for testing TLS certificate parsers. In this blog post, we introduce our research and provide references for security practitioners that are interested in the topic.

Find more details at https://blog.doyensec.com/2020/05/14/asn1fuzz.html

Google Scholar was found to be vulnerable to multiple stored XSS using an exotic technique involving polymorphic images. In this blog post, we explain the bug found and all the possible ways to create and leverage polymorphic images for XSS through a survey of how popular image manipulation libraries in web apps behave when presented with a polymorphic image.

Find more details at https://blog.doyensec.com/2020/04/30/polymorphic-images-for-xss.html

A different pick on bounty programs. Discover how to participate in securing free and open source software, while leveraging your blue team skills. In one of our early research projects we ported libressl to OSS-fuzz, a Google sponsored fuzzer infrastructure for open source projects.

Find more details at https://blog.doyensec.com/2020/04/08/libressl-fuzzer.html

Doyensec discovered a Code Execution vulnerability in Microsoft Visual Studio Code Python Extension (16.5M+ installations at the time of writing).

Find more details and the Proof of Concept in our blogpost: https://blog.doyensec.com/2020/03/16/vscode_codeexec.html

This blog post illustrates a vulnerability we discovered in the popular electron-builder package: a signature validation bypass in the auto-update mechanism could be abused to push malicious updates and execute arbitrary code on the victims' machine. In this blog post, we explain the details of the vulnerability and demonstrate why such fail-open designs are inherently dangerous for security.

Link: https://blog.doyensec.com/2020/02/24/electron-updater-update-signature-bypass.html

This blog post illustrates a vulnerability we discovered in the F-Secure Internet Gatekeeper application. It shows how a simple mistake can lead to an exploitable unauthenticated remote code execution vulnerability.

Link: https://blog.doyensec.com/2020/02/03/heap-exploit.html

Doyensec discovered that an old Android vulnerability involving the `FLAG_SECURE` setting still affected popular mobile password managers for Android (1Password, Keeper, Dashlane, et al).

The article showcases the vulnerabilities found and explains the common underlying problem.

Link: https://blog.doyensec.com/2019/08/22/modern-password-managers-flag-secure.html

In the past three years, Doyensec has been providing security testing services for some of the global brands in the cryptocurrency world. We have audited desktop and mobile wallets, exchanges web interfaces, custody systems, and backbone infrastructure components.

We have seen many things done right, but also discovered many design and implementation vulnerabilities. Failure is a great lesson in security and can always be turned into positive teaching for the future. Learning from past mistakes is the key to create better systems.

Link: https://blog.doyensec.com/2019/08/01/common-crypto-bugs.html

In this article, we explore a Jackson deserialization bug (CVE-2019-12384) discovered during one of our engagements. In particular, we illustrate how an attacker may leverage this deserialization vulnerability to trigger Server-Side Request Forgery (SSRF) and Remote Code Execution (RCE) using a new technique that relies on the popular JDBC/H2 library.

Link: https://blog.doyensec.com/2019/07/22/jackson-gadgets.html

After the first public release of Electronegativity, we had a great response from the community and the tool quickly became the baseline for every Electron app’s security review for many professionals and organizations. This pushed us forward, improving Electronegativity and expanding our research in the field. Today we are proud to release version 1.3.0 with many new improvements and security checks for your Electron applications.

Link: https://blog.doyensec.com/2019/06/11/electronegativity-1.3.html

During one of our projects we had the opportunity to audit a Ruby-on-Rails (RoR) web application handling zip files using the Rubyzip gem. Zip files have always been an interesting entry-point to triggering multiple vulnerability types, including path traversals and symlink file overwrite attacks. As the library under testing had symlink processing disabled, we focused on path traversal exploitation.
This blog post discusses our results, the “bug” discovered in the library itself and the implication of such an issue in a popular piece of software - Metasploit.

Link: https://blog.doyensec.com/2019/04/24/rubyzip-bug.html

We’re back from BlackHat Asia 2019 where we introduced a relatively unexplored class of vulnerabilities affecting Electron-based applications.
Despite popular belief, secure-by-default settings are slowly becoming the norm and the dev community is gradually learning common pitfalls. Isolation is now widely deployed across all top Electron applications and so turning XSS into RCE isn’t child’s play anymore.

Link: https://blog.doyensec.com/2019/04/03/subverting-electron-apps-via-insecure-preload.html

We’re excited to announce the public release of Electronegativity, an opensource tool capable of identifying misconfigurations and security anti-patterns in Electron-based applications.
Electronegativity is the first-of-its-kind tool that can help software developers and security auditors to detect and mitigate potential weaknesses in Electron applications.

Link: https://blog.doyensec.com/2019/01/24/electronegativity.html

Since the first commit back in 2016, burp-rest-api has been the default tool for BurpSuite-powered web scanning automation. Many security professionals and organizations have relied on this extension to orchestrate the work of Burp Spider and Scanner.
Today, we’re proud to announce a new major release of the tool: burp-rest-api v2.0.1.
Starting in June 2018, Doyensec joined VMware in the development and support of the growing burp-rest-api community. After several years of experience in big tech companies and startups, we understand the need for security automation to improve efficacy and efficiency during software security activities. Unfortunately internal security tools are rarely open-sourced, and still, too many companies are reinventing the wheel. We believe that working together on foundational components, such as burp-rest-api, represents the future of security automation as it empowers companies of any size to build customized solutions.

Link: https://blog.doyensec.com/2018/11/05/burp-rest-api-v2.html

With the increasing popularity of the Electron Framework, we have created this post to summarize a few techniques which can be used to instrument an Electron-based application, change its behavior, and perform in-depth security assessments.

Link: https://blog.doyensec.com/2018/07/19/instrumenting-electron-app.html

As part of an engagement for one of our clients, we analyzed the patch for the recent Electron Windows Protocol handler RCE bug (CVE-2018-1000006) and identified a bypass.
Under certain circumstances this bypass leads to session hijacking and remote code execution. The vulnerability is triggered by simply visiting a web page through a browser. Electron apps designed to run on Windows that register themselves as the default handler for a protocol and do not prepend dash-dash in the registry entry are affected.
We reported the issue to the Electron core team (via security@electronjs.org) on May 14, 2018 and received immediate notification that they were already working on a patch. The issue was also reported by Google’s Nicolas Ruff a few days earlier.

Link: https://blog.doyensec.com/2018/05/24/electron-win-protocol-handler-bug-bypass.html

With the increasing popularity of GraphQL technology, in this blog post we are summarizing some documentation and tips about common security mistakes.

Link: https://blog.doyensec.com/2018/05/17/graphql-security-overview.html

Spotlight is the all pervasive seeing eye of the OSX userland. It drinks from a spout of file events sprayed out of the kernel and neatly indexes such things for later use. It is an amalgamation of binaries and libraries, all neatly fitted together just to give a user oversight of their box. It presents interesting attack surface and this blog post is an explanation of how some of it works.

Link: https://blog.doyensec.com/2017/11/15/osx-spotlight.html

At the recent Black Hat Briefings 2017, Doyensec’s co-founder Luca Carettoni presented a new research on Electron security. After a quick overview of Electron’s security model, we disclosed design weaknesses and implementation bugs that can be leveraged to compromise any Electron-based application. In particular, we discussed a bypass that would allow reliable Remote Code Execution (RCE) when rendering untrusted content (for example via Cross-Site Scripting) even with framework-level protections in place.
In this blog post, we would like to provide insight into the bug (CVE-2017-12581) and remediations.

Link: https://blog.doyensec.com/2017/08/03/electron-framework-security.html