Someone from XBOW claimed that they found 23 nginx configs from GitHub vulnerable to nginx-rift.
It turns out 22 out of the 23 were actually PoCs of nginx-rift itself. Not sure about the remaining one. Good call from @julianor.
Here are the 4K nginx configs that we downloaded from GitHub: https://t.co/Ba27Ob6Ttz
We also did a brief analysis of nginx-poolslip, and couldn't find any vulnerable configs either. There were some close calls though.
We'll download and analyze more configs, and share our results later.
Hopefully from now on, whenever someone publishes a new nginx exploit, they also publish whether it can actually be exploited against configs found in the wild on GitHub.
Absence of evidence is not evidence of absence, but it still gives useful data points about how practical these exploits really are. Of course, people should patch anyway.
And to make sure you know it's important, they also published a CVE for this: https://t.co/i5MofhJooN A "vulnerability" that exists only when you provide dhash_entries=1 on the kernel commandline, resulting in a crash of the kernel at boot.
"we had a good thing, you stupid son of a bitch! we had Lows. we had Mediums. we had renderer RCE bonuses, and it all ran like clockwork! you could have shut your mouth, let your fuzzers run, and made as much money as you ever needed! it was perfect! but no, you just HAD to go and flood the team with your AI-hallucinated slop reports"
@gadievron CISOs are going to read ‘181 working Firefox exploits’ and think remote access. But those were generated with sandboxing and other protections off not how anyone runs Firefox. More vulnerabilities ≠ more real world exploit chains. That distinction matters
@RoundtableSpace Red Teamer here, I can 100% confirm that when I hack I use nmap, I like to run apt update and apt upgrade, and call web vulnerabilities a Red Team, this will replace all the Yellow Team, Orange Team, Black Team, PlayStation Team, Xbox Team in CyberSecurity
Which of course you don't have.
What devilish hacking is required to get past this?
Press the "back" key a few times. Should take you back to your dashboard. Instead you get to *the* *other* *company's* *dashboard*.
It really annoys me that ClickFix has a name but especially when it's described as sophisticated or interesting. Oh wow you tricked someone into executing cmd /c, WE GOT AN APT OVER HERE!
$312,500 worth of stored/reflected XSS vulnerabilities in Meta’s Conversions API Gateway allowed Javascript code to run on any Facebook domain and millions of third-party websites. The flaw enabled zero-click Facebook account takeover and more:
https://t.co/7gWpR4LQ8x