Shachar Menashe

[Shachar Menashe @SRMish]

@Star_Knight12 Amazing that React2Shell has already been forgotten... (Next.js CVSS 10.0)

[Shachar Menashe @SRMish]

@amartya_jha_ @0dayPublishing @OpenSearchProj Your response completely proves my point, thank you.
A CVSSv3 8.1 would have been more fitting here, since Attack Complexity is "High" - the attacker needs per-target research to understand where to pass the custom cloning options (if at all possible!)

https://t.co/t6haNNCSdj

[Shachar Menashe @SRMish]

@amartya_jha_ @0dayPublishing @OpenSearchProj I can read just fine. The fact that downstream applications bumped the version does not mean they were vulnerable to this attack to begin with. Show me a popular real-world application that accepts both URL and cloning options from user-supplied input without sanitization.

[Shachar Menashe @SRMish]

@amartya_jha_ @0dayPublishing You should be ashamed of assigning a CVSS 9.8 for this issue. You're actively wasting the time of security teams.
There is no real-world application that uses simple-git and would allow attackers to control both the entire repo URL and the cloning options, this is ridiculous.

[JFrog @jfrog]

For TensorFlow-based Keras #ML models, a major deserialization issue was given the identifier #CVE-2024-3660.

Exploiting this issue allows attackers to inject and execute arbitrary code by crafting a malicious #Keras model file even when operating in Safe Mode.

Deep dive into this new vulnerability: https://t.co/UJb2ooZadF

[Shachar Menashe @SRMish]

If anybody missed our BlackHat USA 2024 talk about vulnerabilities in MLOps platforms - here are our full research findings!

[JFrog Security @JFrogSecurity]

Resulting in 20+ disclosed CVEs to #ML vendors, our team explored the attacks that could be mounted on open source machine learning (#MLOps) platforms used inside organizational networks.

Check out the top learnings and findings here: https://t.co/OsEROT5LfE

[Shachar Menashe @SRMish]

@Techslut @shakedko @JFrogSecurity לא חייבים לבדוק ב-NSA! פייתון עצמם הזכירו את התאריך המדויק (למעשה אנחנו סיפקנו להם את התאריך)
הטוקן היה פומב�� מתאריך 03/03/2023 (כמעט שנה וחצי!)

יש עוד מידע בבלוג שלהם -
https://t.co/yPqvruzAkL

[almog boker @bokeralmog]

דגל בגודל של 17 מטרים על 12 מטרים, הדגל הגדול ביותר בישראל, הונף כעת בנקודה שבה חדרו המחבלים הנאצים מחמאס ורצחו 20 מתושבי נתיב העשרה: מסביב לדגל נשתלו 20 עצי זית עתיקים על שמם ולזכרם של הניספים.
הדרך עוד ארוכה, אבל אנחנו כאן. ומהיום בכל פעם שהמחבלים הארורים ירימו את הראש הם יראו את דגל ישראל ויבינו שאנחנו לא הולכים לשום מקום 🇮🇱

.
תודה לאיתי לוי ולמושב נתיב העשרה על היוזמה, התכנון והביצוע ולחברת ההיטק JFrog שמימנה ותרמה

צילום: אמנון זיו

[Shachar Menashe @SRMish]

@valentijn @roelanddelrue @dcuthbert @0xdade @jrozner @travismcpeak @manicode @semgrep For some languages yes.
Golang - https://t.co/sTeoiPodOe. For example here - https://t.co/CGtNikRSOT, look for "symbols" and "derived_symbols".

Rust - https://t.co/9egg510n8d. For example here - https://t.co/fGAouwJPlm, look for "[affected]"

Not aware of other advisory DBs

[Shachar Menashe @SRMish]

@kingthorin_rm @steveonjava @manicode AFAIK the only exceptions are Go and Rust's vulnerability databases, which do contain the affected symbols for each CVE (for Go it's for all CVEs, for Rust it's only for some of the CVEs). The "govulncheck" command actually makes use of this info!

[Shachar Menashe @SRMish]

@kingthorin_rm @steveonjava @manicode I agree, it's not enough... I happen to lead such a team and the reason that almost everybody is not doing full reachability is because you need an entire research team to classify FOR EACH CVE what the vulnerable function is, it's not available in any machine-readable way today.

[Shachar Menashe @SRMish]

What are you basing this statement on? Do you have a working RCE PoC on an embedded appliance?
Also -
1. It's prior to 3.0.7 (3.0.6 is still vulnerable)
2. It is highly unlikely that an embedded appliance will be running OpenSSL 3.x
3. See this - https://t.co/HXqTzqHKUH

[hacker.house @hackerfantastic]

Many are downplaying this weakness as unlikely to be exploited, however this is incorrect and are many situations - particularly within embedded appliances - where this vulnerability may be triggered and given 4-byte controlled write, exploitation risk on embedded systems is high

[Shachar Menashe @SRMish]

@iamamoose Whether there are compilation or configuration mitigations for this issue (for folks that can't immediately upgrade)

[Shachar Menashe @SRMish]

@pwntester That makes sense, thanks for the clarification!

[Shachar Menashe @SRMish]

@pwntester Are you sure you're not using any additional dependencies such as "org.apache.commons.jexl3"?
On my barebones PoC on Oracle JDK + OpenJDK 17/19 I'm getting 0 script engines available

[Shachar Menashe @SRMish]

Check out my research collaboration with @andre_colonel where we scanned 8+ MILLION OSS packages to find thousands of active API tokens!
Guess how many of those were admin tokens😱

https://t.co/yNprwdzgm5

[Shachar Menashe @SRMish]

@asfkrs @galusben I love it!!

[Shachar Menashe @SRMish]

We uncovered a couple new malware families floating around on PyPI! Check it our technical analysis

[JFrog @jfrog]

JFrog uncovered multiple malicious packages in the #PyPI #Python repository, exploiting developers for data theft, remote code injections, and leaking credit cards. Find out all the details in our new blog post. https://t.co/4zQS0Sl8g9

[Shachar Menashe @SRMish]

PSA - Busybox's wget will silently accept any SSL certificate when downloading over HTTPS (yes, even self signed ones)

[JFrog Security @JFrogSecurity]

Despite a high severity score, a #vulnerability was not patched because it could break existing functionality. Our latest post reviews this situation and why it is unacceptable to sacrifice #security in favor of functionality and release insecure code.
https://t.co/jf1pCjHSB0