Network Attack on 思安录 | Thinking's Security Notes

CVE-2024-24919 Check Point VPN Arbitrary File Read: The Admin Plane on the Public Internet

Thinking — Wed, 15 May 2024 00:00:00 +0000

Check Point’s SSL Network Extender exposes /clients/MyCRL on the public internet without authentication — a single POST reads /etc/passwd. Combined with Censys and nuclei templates, this “admin plane trusts by default” gap is being harvested at scale.

CVE-2024-3400 Palo Alto GlobalProtect Command Injection: a CVSS 10.0 critical chain attack

Thinking — Fri, 12 Apr 2024 00:00:00 +0000

The Palo Alto GlobalProtect command injection scored a perfect 10.0 on CVSS. An unauthenticated attacker sends a crafted request to run arbitrary commands on the firewall and writes a cron job for persistence.

CVE-2023-51766 SMTP Smuggling Recap: Where Exim's End-of-Data Interpretation Breaks

Thinking — Thu, 15 Feb 2024 00:00:00 +0000

Exim before 4.97.1 delegates the decision of “when DATA ends” to whatever bytes the SMTP client carries — effectively outsourcing the trust boundary to the peer. As long as the outbound passes <LF>.<CR><LF> and the inbound accepts it as the end marker, attackers can smuggle arbitrary SMTP commands into the same session.

CVE-2023-31893 Vivo Play IPTV DNS Recursion DoS: amplification attack via carrier firmware

Thinking — Thu, 08 Feb 2024 00:00:00 +0000

Telefônica Brasil’s Vivo Play IPTV device exposes DNS recursion to the public internet. Attackers can use DDoS-Ripper-style amplification tools to knock it offline.

CVE-2023-51766 SMTP Smuggling: Sneaking Forged Mail Past SPF and DMARC

Thinking — Fri, 15 Dec 2023 00:00:00 +0000

The outbound SMTP server treats <LF>.<CR><LF> as ordinary body content; the inbound server treats it as the DATA terminator. That interpretation gap lets an attacker smuggle arbitrary SMTP commands past the recipient, bypassing SPF/DKIM/DMARC and forging mail from gmx.net, web.de, Exchange Online and beyond.

CVE-2023-3519 Citrix NetScaler RCE: Unauthenticated Remote Command Execution

Thinking — Wed, 19 Jul 2023 00:00:00 +0000

Citrix NetScaler is the core entry point for enterprise VPN and remote work — CVE-2023-3519 lets anyone get a root shell with a single HTTP request.

Celer Network cBridge Cross-Chain Bridge Incident Analysis: BGP Hijacking Attack

Thinking — Sat, 20 Aug 2022 00:00:00 +0000

CVE-2020-5902 F5 BIG-IP TMUI RCE: From File Read to Root Command Execution

Thinking — Wed, 01 Jul 2020 00:00:00 +0000

F5 BIG-IP’s TMUI hides an entire layer of “undocumented interfaces” — CVE-2020-5902 exposed the cost of that layer: an unauthenticated remote attacker directly gets a root shell.