This week we have a crazy crypto fail where some Android devices had updates signed by publicly available private keys, as well as some Docker container escapes.
Links and vulnerability summaries for this episode are available at: https://dayzerosec.com/podcast/239.html
[00:00:00] Introduction
[00:00:22] Missing signs: how several brands forgot to secure a key piece of Android
[00:13:37] ModSecurity: Path Confusion and really easy bypass on v2 and v3
[00:21:24] runc process.cwd & leaked fds container breakout [CVE-2024-21626]
[00:24:23] Buildkit GRPC SecurityMode Privilege Check [CVE-2024-23653]
[00:27:49] Jumpserver Preauth RCE Exploit Chain
[00:43:49] 500$: MFA bypass By Race Condition
[00:49:52] HTTP Downgrade attacks with SmuggleFuzz
The DAY[0] Podcast episodes are streamed live on Twitch twice a week:
-- Mondays at 3:00pm Eastern (Boston) we focus on web and more bug bounty style vulnerabilities
-- Tuesdays at 7:00pm Eastern (Boston) we focus on lower-level vulnerabilities and exploits.
We are also available on the usual podcast platforms:
-- Apple Podcasts: https://podcasts.apple.com/us/podcast/id1484046063
-- Spotify: https://open.spotify.com/show/4NKCxk8aPEuEFuHsEQ9Tdt
-- Google Podcasts: https://www.google.com/podcasts?feed=aHR0cHM6Ly9hbmNob3IuZm0vcy9hMTIxYTI0L3BvZGNhc3QvcnNz
-- Other audio platforms can be found at https://anchor.fm/dayzerosec
You can also join our discord: https://discord.gg/daTxTK9
[binary] FORCEDENTRY Sandbox Escape and NetFilter Bugs
[bounty] Spring4Shell, PEAR Bugs, and GitLab Hardcoded Passwords
[binary] Pwning WD NAS, NetGear Routers, and Overflowing Kernel Pages
[bounty] GitLab Arbitrary File Read and Bypassing PHP's filter_var
[binary] Chrome Heap OOB Access and TLStorm
[bounty] DOMPDF XSS to RCE, Chrome Leaking Envrionment Vars, and cr8escape
[binary] A Windows UAF, Branch Prediction Bugs, and an io_uring Exploit
[bounty] Pascom RCE, AutoWarp, and a GKE Container Escape
[binary] Dirty Pipe and Analyzing Memory Tagging
[bounty] Facebook Exploits, pfSense RCE, and MySQLjs SQLi
[binary] ImageGear JPEG Vulns, NetFilter, and a LibCurl Memory Disclosure
[bounty] DynamicWeb RCE, VMWare Bugs, and Exploiting GitHub Actions
[binary] Zynq-7000 Secure Boot Bypass and Compiler-Created Bugs
[bounty] CoinDesk, Zabbix, and Leaking Secrets Through Mirrored Repos
[binary] Another Kernel TIPC Bug, MySQL, and Buggy Go
[bounty] Baby Monitor Bugs, Grafana, and Twitter De-anonymization
[binary] Fastly Infoleak, Samba OOB Access, and Pwning MacOS
[bounty] Hacking Google Drive Integrations and XSS Puzzles
[binary] PwnKit, a Win32k Type Confusion, and Binary Ninja 3.0
[bounty] Zoho Auth Bypass, a Bogus Bug, and Leaking Microsoft Bug Reports
Create your
podcast in
minutes
It is Free
Insight Story: Tech Trends Unpacked
Zero-Shot
Fast Forward by Tomorrow Unlocked: Tech past, tech future
The Unbelivable Truth - Series 1 - 26 including specials and pilot
Lex Fridman Podcast