How the search for deser bugs in #SAP sent @kaidentity down a rabbit hole where he winded up stumbling upon a completely unrelated unauth'ed admin access #CVE-2021-21481 https://t.co/Pk6F4lnpcA
Unauth'd admin access to #SAP#Netweaver? Our very own @kaidentity has you covered, see #CVE-2021-21481 and SAP Security Note 3022422. Better patch than sorry. Our customers got their heads-up already and we'll publish a detailed blog post when appropriate.
@TwitterSupport I truly cannot fathom why this access would ever even exist. This is like an employee having access to unencrypted credit card or bank account numbers. Companies know not to do this. How did Twitter not know this was unacceptably risky??
Once upon a time there was a #Sophos XG Firewall N-day that had @ramoliks and @niph_ dig deep until they got RCE, a 0-day and a comprehensive blog post. #CVE-2020-12271 #CVE-2020-15504 https://t.co/5AkD6fVL1x
@timstrazz@CVEnew@4Dgifts@typo3 Maybe this helps: https://t.co/ujLVG2WD1y
Or read some documentation about the Extbase framework. Without basic TYPO3 architecture knowledge you probably can't understand.
@timstrazz@CVEnew@4Dgifts@typo3 An extension might want to make its controller actions accessible to anonymous callers, like some kind of API. The problem here was that you could make the extension call every controller action of every extension in the system. Now it's been restricted to its own controllers.
@timstrazz@CVEnew@4Dgifts@typo3 The fix makes sure you can only call actions of controllers from the very same extension (and I think there is only one controller). In order to exploit this, you need be able to call controller actions from core extensions. Setting $vendorName=SRBR prevents this.
It is always good to take a 2nd look at existing vulns. So @mwulftange found a new rock-solid exploitation technique for the Telerik UI framework (hint: affects an Avast product ;) Enjoy: https://t.co/eNThRTpoCT #CVE-2017-11317