Karel Origin

[Karel Origin @Karel_Origin]

@_jensec If your job's current state of vulnerability management is an absolute mess, let me know; we can probably be helpful there 😄

[Karel Origin @Karel_Origin]

@_jensec Shameless bit of self-promotion here: I've been working on https://t.co/kX7EDdIrdd for a few years now, and we're doing really solid, unique, interesting work to address challenges in the CVE ecosystem

[Karel Origin @Karel_Origin]

@volosh_sec @galnagli @n8n_io I believe n8n can be self-hosted, so a privilege requirement seems in order

[Karel Origin @Karel_Origin]

@albinowax This is pretty interesting though because the statefulness occurs at the transport layer.

[Karel Origin @Karel_Origin]

I don't think this is as much validation as it is routing. A reverse proxy will likely use the initial host header to determine what the destination should be which will persist for as long as the connection is alive. However, I only see the SSRF occur in very specific scenario's: e.g. an upstream server takes arbitrary host headers but isn't bound to a known list, unlike the first proxy.

[Karel Origin @Karel_Origin]

@jobertabma They called me a mad man

https://t.co/41iBmwRYuq

[Karel Origin @Karel_Origin]

@Hacker0x01 Can we put this on a t-shirt? Doesn't have to be animated.

[Volerion @VolerionSec]

Launching today!

Volerion transforms raw CVEs into structured and instant insights

#CVE #CyberSecurity #infosec

[Karel Origin @Karel_Origin]

@fwrnr @ThisIsDK999 Oh really? Name every webcam

[Karel Origin @Karel_Origin]

@alxbrsn What's the square root of 49

[Karel Origin @Karel_Origin]

@slonser_ @terjanq @serverinspector Ah I see, it's always been so obvious to me that cross-origin navigations are allowed that I never thought to check. Doesn't look like any kind of cross-origin interactions are allowed either

[Karel Origin @Karel_Origin]

@terjanq @slonser_ @serverinspector Under the assumption that the vulnerable page is frameable, an attacker could extract the blob URL via the technique in the original post, poll the attacker server (client-side) for the extracted blob URL, then navigate the top frame to the extracted URL

[Karel Origin @Karel_Origin]

@slonser_ @serverinspector If the vulnerable page is frameable, you can poll your server (or websockets), let the browser wait for the received blob, and redirect to it. Becomes more of a dev issue at that point

[Karel Origin @Karel_Origin]

@rubickcuv5 @Mr_Dark55 I'm not disputing the existence of the issue, but the original post wasn't a valid demonstration of the vulnerability🙂

[Karel Origin @Karel_Origin]

@0xAsm0d3us What is this payload attempting to achieve? The confirm call is not obfuscated, making it no different than just invoking it directly

[Karel Origin @Karel_Origin]

@hakluke Is it PHP code by any chance? /s

[Karel Origin @Karel_Origin]

@intidc Gecondoleerd Inti, veel sterkte voor jou en je familie

[Karel Origin @Karel_Origin]

@zakaria_ounissi @Hogarth45_ @JR0ch17 You don't need a special TLD: https://t.co/jkbsLhwuwf

[Karel Origin @Karel_Origin]

@fwrnr @yaswanth__03 @Bugcrowd https://t.co/pvySMRGJ2F

[Karel Origin @Karel_Origin]

@fwrnr @yaswanth__03 @Bugcrowd I should probably clarify that it doesn't "lead to open redirect". Assuming that the above applies here, then it's just incorrect usage of "open redirect" and a better title would be something along the lines of: "XSS allows page navigation"

Which is still an unusual PoC for XSS