Network Attack

Security Research

CVE-2024-24919 Check Point VPN Arbitrary File Read: The Admin Plane on the Public Internet

CVE-2024-24919 is an arbitrary file read flaw in Check Point Security Gateway's SSL Network Extender, CVSS 8.6. An unauthenticated attacker POSTs to /clients/MyCRL to read /etc/passwd; combined with Censys dorks and nuclei templates, the exposure is harvested at internet scale. The endpoint is a CRL fetcher that returns the contents of a path-attacker-controlled file; the path filter trusts everything after the prefix, so the response leaks any file the gateway process can read. The lesson is that an admin-facing endpoint that accepts user input and returns file contents is a file read primitive; the only safe design is a strict allowlist of paths the system itself owns.

2024-05-15 4 min #Vulnerability Analysis

Security Research

CVE-2024-3400 Palo Alto GlobalProtect Command Injection: a CVSS 10.0 critical chain attack

CVE-2024-3400 is a command injection vulnerability in Palo Alto Networks PAN-OS GlobalProtect, scoring the maximum CVSS 10.0. An attacker triggers command injection via a crafted request and writes a cron job for persistence. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H indicates a chained impact across the entire enterprise. The session-id field flows into a shell command with insufficient escaping, so a single HTTP request can write a cron entry that survives reboots. The vulnerability was weaponized by APT actors within days, and Shadowserver observed mass scanning. The lesson is that an edge device that lets external input land in a shell command is the highest-value target in the perimeter.

2024-04-12 5 min #Vulnerability Analysis

Security Research

CVE-2023-51766 SMTP Smuggling Recap: Where Exim's End-of-Data Interpretation Breaks

CVE-2023-51766 is an SMTP smuggling flaw in Exim before 4.97.1, CVSS 5.3. This piece walks through the protocol-level end-of-data ambiguity, the path that lets outbound servers pass . while inbound Exim treats it as DATA termination, and the boundary conditions against GMX/Ionos/Exchange Online. The end-of-data sequence is a single byte: the line containing only a period (.). RFC 5321 calls it the data terminator, but the surrounding CR/LF rules differ across implementations; Exim historically accepted any of LF.LF, CR.LF, or LF. as a valid terminator, while many outbound senders emit a stricter one. An attacker who can choose the outbound terminator can hide a second envelope inside the same message. The lesson is that SMTP is line-oriented and tolerant, and tolerance at the protocol layer is a smuggling channel.

2024-02-15 6 min #Vulnerability Analysis

Security Research

CVE-2023-31893 Vivo Play IPTV DNS Recursion DoS: amplification attack via carrier firmware

CVE-2023-31893 is a DNS recursion DoS in Telefônica Brasil's Vivo Play IPTV device (firmware 2023.04.04.01.06.15), CVSS 7.5. The device exposes DNS recursion to the public internet, letting an attacker spoof source IPs in DNS queries to trigger amplification responses that overwhelm the device. The fix is to disable recursion and restrict recursive clients to trusted networks. Open DNS recursion has been a known DoS primitive for two decades, yet carrier-grade CPE still ships with recursion enabled for the LAN. A single open resolver on the network becomes an amplification target: the attacker sends small DNS queries with the victim's IP as the source, and the resolver dutifully returns much larger responses. The lesson: any network device that listens on UDP/53 should default to no recursion, and recursion should be a deliberate per-VLAN config, not a build default.

2024-02-08 6 min #Vulnerability Analysis

Security Research

CVE-2023-51766 SMTP Smuggling: Sneaking Forged Mail Past SPF and DMARC

CVE-2023-51766 is an SMTP smuggling flaw in Exim prior to 4.97.1, scored CVSS 5.3. The core trick is that the outbound SMTP server treats a sequence like . as ordinary body text, while the inbound SMTP server treats the same sequence as the DATA terminator. That semantic disagreement lets an attacker piggyback arbitrary MAIL FROM, RCPT TO, and BDAT commands inside what looks like one message, so a sender using a shared IP pool (GMX, Ionos, Exchange Online) can impersonate any domain hosted on those providers. SPF and DKIM still pass, and DMARC alignment succeeds, because the inbound server sees the second message as a freshly arrived, internally valid SMTP session. The fix is not more authentication; it is strict outbound filtering of terminator-like sequences, upgrading inbound Exim, and broader adoption of BDAT to retire the legacy `.` terminator.

2023-12-15 6 min #Vulnerability Analysis

Security Research

CVE-2023-3519 Citrix NetScaler RCE: Unauthenticated Remote Command Execution

CVE-2023-3519 is an unauthenticated remote code execution in Citrix NetScaler ADC and NetScaler Gateway prior to 13.1-49.15, scored CVSS 9.8. NetScaler's NSPPE packet processing engine has a heap buffer overflow in the HTTP request parser that lets a specially crafted HTTP request overwrite the return address and run shellcode directly inside the nsroot process — meaning a single unauthenticated request yields a root-equivalent shell. Mandiant and CISA warned in 2023-07 that APT groups had already weaponised it against US critical infrastructure, exfiltrating SSL VPN configurations and private certificates. The remediation is to upgrade immediately, force-rotate every SSL VPN private certificate (assume all credentials are now burned), restrict the management interface from external access, and watch `/tmp/` for the suspicious files attackers typically drop.

2023-07-19 4 min #Vulnerability Analysis

Security Research

Celer Network cBridge Cross-Chain Bridge Incident Analysis: BGP Hijacking Attack

On August 18, 2022, Celer Network cBridge suffered a BGP Hijacking attack. The attacker hijacked the underlying Internet routing protocol to redirect cross-chain users to a malicious frontend. Through certificate analysis, AS routing tracing, and BGP Trace records, the SlowMist security team confirmed this was a targeted BGP hijacking attack against Celer Network.

2022-08-20 7 min #Web3 Security

Security Research

CVE-2020-5902 F5 BIG-IP TMUI RCE: From File Read to Root Command Execution

CVE-2020-5902 is a pre-authentication RCE in F5 BIG-IP's Traffic Management User Interface, scored CVSS 9.8. The flaw chains a directory-traversal bypass in the TMUI URL parser with the hidden tmsh alias interface, letting an unauthenticated remote attacker read arbitrary files and ultimately land a root shell on the appliance. F5's TMUI exposes an entire layer of developer-intended endpoints (fileRead.jsp, tmshCmd.jsp) that should never be reachable from outside. The trust model that BIG-IP's ADC layer sits on collapses the moment that layer is reachable.

2020-07-01 5 min #Vulnerability Analysis