Subscribe via feed.
Archive for May, 2019

PHP PHP_INI_SYSTEM Ineffective Controls

Posted by deepcore under exploit (No Respond)

Security controls configured via php.ini directives at the PHP_INI_SYSTEM level are ineffective as they could be bypassed by malicious scripts via writing their own process memory on the Linux platform. Proof of concept code included.

JavaScriptCore LICM Uninitialized Stack Variable

Posted by deepcore under exploit (No Respond)

JavaScriptCore loop-invariant code motion (LICM) in DFG JIT leaves a stack variable uninitialized.

Microsoft Windows CmKeyBodyRemapToVirtualForEnum Arbitrary Key Enumeration

Posted by deepcore under exploit (No Respond)

The Microsoft Windows kernel’s Registry Virtualization does not safely open the real key for a virtualization location leading to enumerating arbitrary keys resulting in privilege escalation.

XNU stf_ioctl Bad Cast

Posted by deepcore under exploit (No Respond)

XNU suffers from a wild-read (and possible corruption) due to bad cast in stf_ioctl.

Darktrace Enterpise Immune System 3.0.9 / 3.0.10 Cross Site Request Forgery

Posted by deepcore under exploit (No Respond)

Darktrace Enterprise Immune System versions 3.0.9 and 3.0.10 contain multiple cross site request forgery vulnerabilities. It is highly likely that older versions are affected as well, but this has not been confirmed. An attacker can whitelist domains and/or change core Darktrace configuration.

Visual Voicemail For iPhone IMAP NAMESPACE Use-After-Free

Posted by deepcore under exploit (No Respond)

Visual Voicemail for iPhone suffers from a use-after-free vulnerability in IMAP NAMESPACE processing.

XNU Stale Pointer Use-After-Free

Posted by deepcore under exploit (No Respond)

XNU suffers from a use-after-free vulnerability due to a stale pointer left by in6_pcbdetach.

Shopware createInstanceFromNamedArguments PHP Object Instantiation

Posted by deepcore under exploit (No Respond)

This Metasploit module exploits a php object instantiation vulnerability that can lead to remote code execution in Shopware. An authenticated backend user could exploit the vulnerability. The vulnerability exists in the createInstanceFromNamedArguments function, where the code insufficiently performs whitelist check which can be bypassed to trigger an object injection. An attacker can leverage this to […]

Mac OS X Feedback Assistant Race Condition

Posted by deepcore under exploit (No Respond)

This Metasploit module exploits a race condition vulnerability in Mac’s Feedback Assistant. A successful attempt would result in remote code execution under the context of root.

FreeBSD rtld execl() Privilege Escalation

Posted by deepcore under exploit (No Respond)

This Metasploit module exploits a vulnerability in the FreeBSD run-time link-editor (rtld). The rtld unsetenv() function fails to remove LD_* environment variables if __findenv() fails. This can be abused to load arbitrary shared objects using LD_PRELOAD, resulting in privileged code execution.