Kai Ullrich

[CODE WHITE GmbH @codewhitesec]

How the search for deser bugs in #SAP sent @kaidentity down a rabbit hole where he winded up stumbling upon a completely unrelated unauth'ed admin access #CVE-2021-21481 https://t.co/Pk6F4lnpcA

[CODE WHITE GmbH @codewhitesec]

Unauth'd admin access to #SAP #Netweaver? Our very own @kaidentity has you covered, see #CVE-2021-21481 and SAP Security Note 3022422. Better patch than sorry. Our customers got their heads-up already and we'll publish a detailed blog post when appropriate.

[Brandon Arentson @RocketsAreFun_]

@TwitterSupport I truly cannot fathom why this access would ever even exist. This is like an employee having access to unencrypted credit card or bank account numbers. Companies know not to do this. How did Twitter not know this was unacceptably risky??

[CODE WHITE GmbH @codewhitesec]

Once upon a time there was a #Sophos XG Firewall N-day that had @ramoliks and @niph_ dig deep until they got RCE, a 0-day and a comprehensive blog post. #CVE-2020-12271 #CVE-2020-15504 https://t.co/5AkD6fVL1x

[Kai Ullrich @kaidentity]

@timstrazz @CVEnew @4Dgifts @typo3 Maybe this helps: https://t.co/ujLVG2WD1y
Or read some documentation about the Extbase framework. Without basic TYPO3 architecture knowledge you probably can't understand.

[Kai Ullrich @kaidentity]

@timstrazz @CVEnew @4Dgifts @typo3 An extension might want to make its controller actions accessible to anonymous callers, like some kind of API. The problem here was that you could make the extension call every controller action of every extension in the system. Now it's been restricted to its own controllers.

[Kai Ullrich @kaidentity]

@timstrazz @CVEnew @4Dgifts @typo3 The fix makes sure you can only call actions of controllers from the very same extension (and I think there is only one controller). In order to exploit this, you need be able to call controller actions from core extensions. Setting $vendorName=SRBR prevents this.

[TYPO3 Security @typo3_security]

TYPO3-EXT-SA-2019-018: Remote Code Execution in extension "freeCap CAPTCHA" (sr_freecap)
https://t.co/1J57DwjOjD

[CODE WHITE GmbH @codewhitesec]

It is always good to take a 2nd look at existing vulns. So @mwulftange found a new rock-solid exploitation technique for the Telerik UI framework (hint: affects an Avast product ;) Enjoy: https://t.co/eNThRTpoCT #CVE-2017-11317

[Chris Frohoff @frohoff]

Write-ups on three recent WebLogic #javadeser RCEs (translated from chinese):

https://t.co/bj9sMw8Iyc

https://t.co/EDYpZh09sm

[Markus Wulftange @mwulftange]

We have published the RichFaces vulnerability details on the @codewhitesec blog at https://t.co/nhicitJFcU

[CODE WHITE GmbH @codewhitesec]

Interested in Advanced Java Exploitation? Check out our new blog post about exploiting Adobe ColdFusion https://t.co/P4CeL7HU0n

[Kai Ullrich @kaidentity]

@cyberApostle Thanks

[Kai Ullrich @kaidentity]

Check out my post about handcrafted gadgets and a groovy 2.4.5 gadget https://t.co/uP7fVyYqVz