Yaniv Nizry

Security researcher

[Sonar Research @Sonar_Research]

Can you trust the trust dialog?

We discovered that running Claude Code in malicious folders could have executed system commands before the trust dialog even appears! Learn about the details in our latest blog post:

https://t.co/tw1f6fWNrM

#appsec #security #vulnerability

[Yaniv Nizry @YNizry]

Just published two new vulnerability write-ups:

💻FortiClient – Two-click RCE via code injection in the login window
https://t.co/ga7YeSpfwj
⚠️FortiGuard – “Access Blocked” page XSS
https://t.co/tHsBJLhIL2

[Yaniv Nizry @YNizry]

TROOPERS talks are now live on YouTube!
Curious how attackers can turn endpoint protection into an entry point?
In my session, I break down exactly how these compromises happen - step by step.
🎥 Watch here: https://t.co/VpH0t9c7EC

[Sonar Research @Sonar_Research]

🔄📦 GitHub Actions offer powerful automation capabilities for CI/CD, but they're not immune to attacks.
Take a look at how we tackle this risk with SonarQube Cloud by diving into real-world vulnerabilities.

https://t.co/V9m3HXtRQv

#appsec #security #vulnerability

[Sonar Research @Sonar_Research]

🗒️✍️Taking a note on security: our latest blog post focuses on Go vulnerabilities, including Arbitrary File Write, XSS, and Misconfiguration. Showcasing our new support for the language in SonarQube Cloud!

https://t.co/7UkA5Z4XVI

#appsec #security #vulnerability

[Sonar Research @Sonar_Research]

🔓⏫ After compromising every endpoint within an organization, our “Caught in the FortiNet” series comes to an end with one more thing.
Read more about FortiClient's XPC mistake that allows local privilege escalation to root on macOS

https://t.co/5WNdG3vIlt

#appsec #security

[Yaniv Nizry @YNizry]

[2/2] Meaning that if you have a file write and can't control the extension and the extension doesn't correlate to any Content-Type (let's say .abc), you can add .html to the file name (https://t.co/OwiPnn2LEx) and httpd will serve it as text/html

[Yaniv Nizry @YNizry]

[1/2] TL;DR: mod_mime, Apache httpd module that is responsible for assigning Content-Type, supports "Files with Multiple Extensions".
#bugbountytips

[Sonar Research @Sonar_Research]

📁🫷🚧Can't control the extension of a file upload, but you want an XSS?
Read more on how we overcame this obstacle to further exploit entire organizations using Fortinet endpoint protection:

https://t.co/OM0OQvlwgF

#appsec #vulnerability #bugbountytips

[Yaniv Nizry @YNizry]

[2/2] Meaning that if you have a file write and can't control the extension and the extension doesn't correlate to any Content-Type (let's say .abc), you can add .html to the file name (https://t.co/OwiPnn2LEx) and httpd will serve it as text/html

[pspaul @pspaul95]

Great bug chain by @YNizry that can pwn a whole org, starting with a single user click! I was also able to contribute a bit by creating my first port of a Chrome n-day exploit :)

[Yaniv Nizry @YNizry]

It was a pleasure to speak at #TROOPERS25 about my Fortinet findings. In case you missed it and don't want to wait for the recording, the first blog post is now live:

[Sonar Research @Sonar_Research]

🕸️🏢Caught in the FortiNet: Exploiting Fortinet’s endpoint protection solution to compromise an entire organization using minimal user interaction.
Dive into our technical analysis of this interesting attack scenario:

https://t.co/PtpmvKkeui

#appsec #security #vulnerability

[Sonar Research @Sonar_Research]

Catch our second talk at #TROOPERS25:

🕸️ Caught in the FortiNet: Compromising Organizations Using Endpoint Protection

@YNizry will tell you the story of multiple vulnerabilities in Fortinet products that can compromise an entire organization, starting with a single click

[Sonar Research @Sonar_Research]

📁 Using polyglot file and RXSS to achieve one-click RCE on a Voyager instance.

Read more about how SonarQube Cloud detected CVE-2024-55417 in our latest blog post:

https://t.co/U9MfSxBuJI

#appsec #security #vulnerability

[Yaniv Nizry @YNizry]

Recently, I had the opportunity to reverse engineer and debug binaries on macOS 🪲🔍
I faced some Apple limitations during setup and struggled to find good beginner resources, so I wrote a short blog post to help others.

https://t.co/NnlySH5Mqs

#macos #debugging #lldb

[Yaniv Nizry @YNizry]

🧬🔬 I wrote about this finding a bit more extensively in my blog:
https://t.co/3CeEnbSutq

#mXSS #XSS

[Sonar Research @Sonar_Research]

🧵 [1/4] Here is our DOMPurify 3.2.1 bypass, using a namespace confusion technique where each element is initially in a “correct” namespace.

When it was allowed, the ‘is’ attribute was not handled correctly, making the attribute content’s regex check obsolete.

#mXSS #XSS

[Sonar Research @Sonar_Research]

The reason most PHP-based HTML sanitizers are inherently vulnerable to bypasses is just the tip of the iceberg🥶.

Check out our latest blog post to learn why server-side sanitization is doomed to fail.

https://t.co/ricaduPHf7

#appsec #security #vulnerability #php

[Sonar Research @Sonar_Research]

Join us at OWASP SF for our talk, "Sanitize Client-Side: Why Server-Side HTML Sanitization is Doomed to Fail" to discover why client-side sanitization is crucial for a secure web. Can't make it? Stay tuned for our upcoming blog post.

#OWASP #GlobalAppSecSanFran

[Sonar Research @Sonar_Research]

Browsers don’t protect users from CSRF attacks when a website is using the convenient basic HTTP authentication method.
Take a look at how SonarCloud found vulnerabilities in pyspider:

https://t.co/Z7ftit5bWl

#appsec #security #vulnerability

[Sonar Research @Sonar_Research]

The simple <script> XSS didn’t work? Don’t give up before trying some mXSS magic🪄.
Get to know the fundamentals of this bug class on your way to becoming a master of sanitizer bypasses:

https://t.co/ZBzN4g0o3s

#appsec #security #vulnerability #mXSS