malerisch.net

I have promised I would have something written about my Hack In the Box 2012 Amsterdam  conference experience. First thing, it was one of the best security conference I have ever been. Big props to Dhillon ( @l33tdawg ) and the HITB crew for organising such event. I have been organising conferences in the past ( OWASP NZ Day 2009 and 2010 ) and I know something about what happens in the background. The conference venue was awesome, a pimping five stars hotel ;-) and again need to thank the crew for the wise choice. Bad thing is that I checked out with my wallet "lighter" than usual, after having dinners at the Japanese restaurants and trying all the amenities of the fitness center. My talk ( pdf || slideshare ) was on the first day along with two other media interviews with Mirko Zorz ( @helpnetsecurity ) of Help Net Security and Edward Kovacs ( @EduardKovacs ) of Softpedia. Both interviews went pretty well and they will be published soon. Unfortunately,...

Following disclosure of Oracle bugs , here is another bug found in Oracle GlassFish Server 3.1.1. The interesting part of this advisory is the exploit. When looking at the features of the Oracle GlassFish Server, I have noticed that with a XSS it would be possible to steal the session token and bypass HTTPOnly protection. I have found this condition to be true if a user is authenticated to the REST interface, which does not have the same security controls of the main web administrative interface. Quite an interesting point to keep in consideration when testing applications that come with a standard interface and a REST interface as well. Details Vendor Site: Oracle (www.oracle.com) Date: April, 19th 2012 – CVE 2012-0551 Affected Software: Oracle GlassFish Server 3.1.1 (build 12) Researcher: Roberto Suggi Liverani PDF version: http://www.security-assessment.com/files/documents/advisory/Oracle_GlassFish_Server_Multiple_XSS.pdf Description Security-Assessment.com has discover...

Time for some disclosure. Below, details of a CSRF bug discovered in Oracle GlassFish Server 3.1.1 few months ago. Interesting to observe that Oracle rates this as the third most critical bug fixed among the Oracle Sun Products. I guess that's because of the exploit which was included in the original report and which I am releasing as part of this advisory. I found a curios angle to exploit this bug, as arbitrary file upload of a WAR archive can be performed. A quite cool way to exploit a CSRF and own Oracle GlassFish, if you ask me :-). Enjoy. Details Vendor Site:  Oracle (www.oracle.com) Date:  April, 19th 2012 – CVE 2012-0550 Affected Software:  Oracle GlassFish Server 3.1.1 (build 12) Researcher:  Roberto Suggi Liverani PDF version:  http://www.security-assessment.com/files/documents/advisory/Oracle_GlassFish_Server_REST_CSRF.pdf Description Security-Assessment.com has discovered that the Oracle GlassFish Server REST interface is vulnerable to C...

In about six weeks time, I will be in .eu presenting at Hack In The Box Amsterdam 2012 . I am very excited about it as that will be my first HITB conference. Also, the speakers line-up and conference agenda are impressive. This time, I will be presenting with Scott Bell, my colleague at Security-Assessment.com . The presentation will cover the results of our research which focuses on browser bug hunting. Certainly, there is no fun without dropping some 0days... so expect to see some cool bugs if you are attending our talk. If not, you will be able to grab demos, videos and slides following the conference. Here is the talk abstract: Window Shopping: Browser Bug Hunting in 2012 Web browsers have become part of everyday life, and are relied upon by millions of internet citizens each day. The feature rich online world has turned the once simple web browser into a highly complex (and very often insecure) desktop application. As browser vendors have extended functionality and supp...

A couple of weeks ago I have found myself working on a CSRF File Upload Proof-of-Concept (PoC) for a bug I have found in an Oracle product. I remember that Krzysztof Kotowicz did some research on a similar PoC not long time ago. A quick Google search brought me to his article on invisible arbitrary file upload in Flickr. So instead of reinventing the wheel, I have tried to use his PoC code available here . Unfortunately, the code was not working in my case and I was unsure whether that was depending on the browsers I was using (Firefox 8.0.1 and Chrome 15.0.874.121) and/or on the vulnerable application itself. Consequently, I have spent some time to come up with a PoC (or probably a good term would be a collage ) which would work in my case. The technique used is the same illustrated in Kotowicz's research and more information can be found here . In few words, the exploitation process is divided in two steps: 1) Use XHR to get a binary file and store it as a JavaScript ob...

I recently decided to use Blogger.com for my blogging activity. Here is the URL of the new blog:  http://blog.malerisch.net All previous articles and research can still be found at my previous site: http://malerisch.net In future, articles will only appear here. So make sure to bookmark this site or follow feeds to get timely updates. Thanks for your attention.