DFIR Lab

[DFIR Lab @DFIR_Lab]

Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents.

[DFIR Lab @DFIR_Lab]

Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data.

[DFIR Lab @DFIR_Lab]

Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to attach a paid subscription to an existing member, modify that member's name, and inject content into newsletters sent to the member. Depending on the recipient's email client, the injected content may be rendered, resulting in HTML injection or cross-site scripting (XSS).

[DFIR Lab @DFIR_Lab]

Fleet versions before 4.87.0 contain an authentication bypass vulnerability in the device API that accepts hostnames and hardware serials as authentication tokens in addition to device UUIDs. Unauthenticated attackers who know or guess these non-secret identifiers can authenticate as iOS/iPadOS hosts to read device data and trigger device-scoped actions including software installation and MDM migration.

[DFIR Lab @DFIR_Lab]

tls_opt_dtls_peer_connection_id_value_get() in subsys/net/lib/sockets/sockets_tls.c, which handles getsockopt(SOL_TLS, TLS_DTLS_PEER_CID_VALUE), passed the caller-supplied optval directly to mbedtls_ssl_get_peer_cid() without verifying the buffer was at least MBEDTLS_SSL_CID_OUT_LEN_MAX (default 32) bytes. mbedtls_ssl_get_peer_cid() copies the peer-negotiated DTLS Connection ID (length 1..MBEDTLS_SSL_CID_OUT_LEN_MAX) into that buffer without a destination-size parameter, so a caller-supplied optlen smaller than the CID causes a write of up to 31 bytes past the buffer end.

In CONFIG_USERSPACE builds the getsockopt syscall verifier (z_vrfy_zsock_getsockopt) bounce-buffers the user's optval into a kernel allocation of exactly optlen bytes (k_usermode_alloc_from_copy -> z_thread_malloc), so an unprivileged user thread that passes a small optlen on a connected DTLS socket with Connection ID enabled induces a kernel-heap buffer overflow, with the overflowing content being the remote peer's CID.

The defect requires CONFIG_MBEDTLS_SSL_DTLS_CONNECTION_ID, an established DTLS session with a negotiated peer CID, and (for the kernel-crossing case) CONFIG_USERSPACE. Introduced when the TLS_DTLS_CID option was added (v3.5.0).

The fix rejects callers whose optlen is below MBEDTLS_SSL_CID_OUT_LEN_MAX with -EINVAL.

[DFIR Lab @DFIR_Lab]

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_within_directory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink members or traversal sequences to write files to arbitrary filesystem locations accessible to the process.

[DFIR Lab @DFIR_Lab]

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.29.0, the validate_template and render_template calls in erpnext/accounts/doctype/process_statement_of_accounts/process_statement_of_accounts.py render subject, body, and pdf_name fields with unrestricted globals including frappe.utils, allowing an authenticated user with a common operational role to inject template expressions, execute arbitrary server-side code, and read data across the application. This issue is fixed in versions 15.118.0 and 16.29.0.

[DFIR Lab @DFIR_Lab]

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/account.py, erpnext/accounts/doctype/process_payment_reconciliation/process_payment_reconciliation.py, erpnext/accounts/doctype/purchase_invoice/purchase_invoice.py, and erpnext/accounts/utils.py omit required write permission checks, allowing authenticated limited users to modify protected data beyond their roles. This issue is fixed in versions 15.112.0 and 16.22.0.

[DFIR Lab @DFIR_Lab]

🔍 Tool Tuesday: Volatility 3 — The Gold Standard in Memory Forensics

When you need to analyze a memory dump from a compromised system, Volatility 3 is the framework that separates signal from noise. This open-source powerhouse supports Windows, Linux, and macOS memory analysis with a plugin-based architecture that puts hundreds of analysis capabilities at your fingertips.

Volatility 3 is a complete Python 3 rewrite of the original framework, bringing massive improvements to symbol table management and cross-platform analysis. Core plugins like pslist, netscan, malfind, handles, and dlllist form the foundation of most memory investigations. The malfind plugin alone has caught countless instances of process injection and hidden malware that traditional disk forensics would miss entirely.

Real-world scenario: During a suspected APT compromise, traditional EDR showed nothing suspicious. A memory dump analyzed with Volatility revealed a hollowed-out svchost.exe process with injected shellcode, hidden network connections to a C2 server, and driver objects with no corresponding files on disk. The pslist and netscan plugins identified the anomalies, while malfind pinpointed the exact injection points.

The community plugin ecosystem extends Volatility for specific malware families, custom detection logic, and specialized analysis needs. Whether you're hunting rootkits, analyzing fileless malware, or reconstructing attacker activity, Volatility 3 remains the framework every memory forensics practitioner needs in their toolkit.

Get it: hXXps://github[.]com/volatilityfoundation/volatility3

#DFIRTools #DigitalForensics

[DFIR Lab @DFIR_Lab]

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized access to workflows, executions, and credential secrets within the API key's scope.

[DFIR Lab @DFIR_Lab]

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerability in Resource Locator parameter dropdown link handling. Workflow authors can inject malicious script URLs that execute arbitrary JavaScript in the editor origin when other users open the node dropdown and click the external-link icon, with the payload persisting across workflow imports and shares.

[DFIR Lab @DFIR_Lab]

ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated attackers to execute arbitrary SQL during first-run setup mode. Attackers can invoke setup.restore via https://t.co/S1SfIqmcs3 to plant admin users and forged session tokens, then authenticate as administrator without credentials for complete application takeover.

[DFIR Lab @DFIR_Lab]

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required form submission nonce is freely obtainable by unauthenticated users via the publicly accessible wp_ajax_nopriv_forminator_get_nonce endpoint, making the full attack chain exploitable without any authentication or prior account.

[DFIR Lab @DFIR_Lab]

The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in all versions up to, and including, 1.5.97 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the 'list_readmore_numberofwords' Other Parameters setting to be configured with a positive integer value; the default value of 0 bypasses the decode-and-truncate branch entirely and is not exploitable through this sink.

[DFIR Lab @DFIR_Lab]

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives initial storage because WooCommerce's sanitize_text_field() and wc_clean() do not strip entity-encoded strings containing no literal '<' character, allowing unauthenticated guest-checkout orders to plant the malicious content.

[DFIR Lab @DFIR_Lab]

🎯 DFIR Suite API Spotlight: AI Threat Actor Profiling

POST /ai/threat-profile — Turn raw IOCs and campaign data into actionable threat intelligence.

You've just wrapped an incident. You have a pile of IOCs, some lateral movement artifacts, and exfil patterns. Management wants to know: who did this, why us, and what's next?

This endpoint takes your observables and returns an AI-generated threat actor profile. It maps your TTPs to MITRE ATT&CK, cross-references known campaigns, and delivers likely attribution, adversary motivation, target sectors, and historical context. Perfect for threat intel reports, executive briefings, or understanding who you're really up against.

At 20 credits per request, it's the most comprehensive AI analysis in the suite — combining ATT&CK mapping with contextual intelligence. When you need to move from "we got hit" to "here's who, why, and what they're after," this is your go-to.

Endpoint: hXXps://api[.]dfir-lab[.]ch/v1/ai/threat-profile
Docs: hXXps://platform[.]dfir-lab[.]ch/docs/ai/threat-profile

#DFIR #ThreatIntel

[DFIR Lab @DFIR_Lab]

🔍 IOC Enrichment Lookup — One API Call, Complete Context

How many tabs do you have open right now checking an IP across VirusTotal, AbuseIPDB, Shodan, and three threat intel feeds?

The DFIR Suite /enrichment/lookup endpoint consolidates that entire workflow into a single POST request. Submit any IOC — IP address, domain, file hash, URL, or email — and get back multi-source enrichment in seconds: risk score, threat classifications, associated malware families, related indicators, and more.

Real-world scenario: You're triaging an alert on a suspicious outbound connection to 185.220.101.x. Instead of manually pivoting across five different platforms, you fire one API call. The response tells you it's a known Tor exit node with recent associations to Emotet C2 infrastructure, risk score 85/100, and three related domains observed in the same campaign. You've got the context you need to escalate — or dismiss — in under 30 seconds.

This is built for automation. Plug it into your SOAR playbooks, enrich every alert at scale, and stop context-switching between browser tabs during an active incident. The endpoint works with all IOC types, cross-references against commercial threat intel feeds and OSINT sources, and costs just 3 credits per lookup.

API details: POST hXXps://api[.]dfir-lab[.]ch/v1/enrichment/lookup | 3 credits | Available on all plans

Docs: hXXps://platform[.]dfir-lab[.]ch/docs/enrichment/lookup

#DFIR #ThreatIntel

[DFIR Lab @DFIR_Lab]

🚨 MITRE Technique Spotlight: T1190 — Exploit Public-Facing Application

Initial access doesn't always require phishing. Adversaries increasingly target internet-facing infrastructure—web apps, VPNs, firewalls, and email gateways—to gain their first foothold.

Recent campaigns show this trend clearly: MOVEit Transfer exploitation (CVE-2023-34362) by Cl0p ransomware gang, Citrix Bleed (CVE-2023-4966) enabling session hijacking, and Ivanti Connect Secure vulnerabilities (CVE-2024-21887) chained for pre-auth RCE. These aren't theoretical—they're active, widespread, and devastating.

Detection requires layered visibility:
• WAF logs showing SQL injection, path traversal, or deserialization attempts
• IDS/IPS signatures firing on exploit payloads
• Web server access logs with anomalous POST requests, unusual user-agents, or 200 responses to non-existent paths
• EDR alerts on unexpected child processes from w3wp.exe, httpd, tomcat, or java.exe
• Webshell indicators: aspx/jsp/php files in web directories with eval(), base64_decode(), or cmd.exe execution

Log sources: IIS logs (W3C format), Apache access/error logs, Sysmon Event ID 1 (process creation) from web server hosts, firewall connection logs, and application-specific logs (e.g., Tomcat catalina[.]out).

Patch management isn't sexy, but it's your first line of defense. Vulnerability scanning must cover external attack surface continuously—not quarterly.

#MITREATTACK #ThreatIntel

[DFIR Lab @DFIR_Lab]

🚨 HIGH severity CVE-2026-72903 (CVSS 8.1) affects Tabby terminal emulator &lt;1.0.235. Malicious SFTP servers can exploit path traversal to write files outside intended directories on Windows. Update immediately. #CVE #Vulnerability #PatchNow

[DFIR Lab @DFIR_Lab]

🚨 HIGH severity CVE-2026-11810 (CVSS 7.5)

UpdateHub firmware-update agent vulnerable to remote DoS via NULL pointer dereference. Malicious update server can crash devices by sending malformed JSON metadata.

Patch immediately.

#CVE #Vulnerability #PatchNow