December 2018 Summaries

Detectify celebrated a year of significant achievements in 2018, including raising €5 million in a Series A funding round led by Insight Venture Partners, which supports its international expansion and research and development efforts. The company expanded its white hat hacker platform, Detectify Crowdsource, resulting in over 50,000 unique vulnerability findings, and hosted several Hacker Schools and Dinners to foster knowledge sharing and community building. Detectify also achieved advanced technology partner status with AWS and launched new features like Domain Monitoring Service and API v2 to enhance integration and user experience. The company expanded its team to include 22 new employees from 18 different nationalities, moved into a larger office, and received accolades such as the Most Promising Cybersecurity Solution award at PwC’s Cybersecurity Week. With a focus on continuous improvement and innovation, Detectify looks forward to further growth and success in the coming year.

In 2018, the cybersecurity landscape was marked by significant vulnerabilities and breaches, highlighting the urgent need for stronger security measures. Major incidents included the Meltdown and Spectre vulnerabilities affecting nearly all computing devices, the Facebook “View As” feature hack compromising 50 million users, and Marriott's data breach exposing information of 500 million guests. The year also saw numerous companies suffer from misconfigured AWS S3 buckets, prompting Amazon to enhance privacy settings, and the implementation of GDPR, which immediately resulted in fines for Google and Facebook. Magecart's theft of credit card information via compromised third-party JavaScript, Reddit’s experience with SMS 2FA vulnerabilities, and the Drupalgeddon v2.0 vulnerability demonstrated the persistent threat of cyberattacks. Google's Parisa Tabriz urged companies to adopt long-term security strategies, emphasizing the need for proactive defense and a security-centric culture. Looking ahead to 2019, experts anticipate an increase in cloud-related security issues, serverless architecture vulnerabilities, and a shift towards proactive security practices fueled by regulations like GDPR and the rise of DevSecOps.

The jQuery-File-Upload, a popular JavaScript repository on GitHub, has been found to contain three significant vulnerabilities, two of which allow remote code execution and one that enables unauthorized file deletion. These vulnerabilities, analyzed by Detectify Crowdsource, include CVE-2018-9206, which involves unauthenticated arbitrary file upload due to improper server configuration and reliance on Apache's .htaccess. This issue was exacerbated by Apache's discontinuation of default .htaccess support from version 2.3.9 onwards. Another vulnerability involves the use of ImageMagick, enabling remote code execution through GhostScript, also known as ImageTragick (CVE-2016-3714). The third vulnerability, considered an insecure direct object reference, allows unauthorized access and deletion of uploaded files, which poses privacy risks on platforms using jQuery-File-Upload. The first two vulnerabilities have been patched in the latest version, and users are advised to update their software and restrict access to sensitive endpoints to mitigate the third vulnerability.

Detectify provides continuous security updates every two weeks, incorporating new findings, features, and improvements sourced from their security researchers and the Crowdsource ethical hacker community. While confidentiality agreements prevent the public release of all updates, they are immediately integrated into the Detectify scanner for user access. Recent updates include addressing vulnerabilities such as CVE-2018-14912 related to cgit path traversal, CVE-2018-5006 involving Adobe AEM SSRF, and Apache Hadoop RCE, among others. Specific vulnerabilities like jQuery-File-Upload related issues, CVE-2018-9845 concerning Etherpad authentication bypass, exposed Docker configuration files, and header-based SSRF and URL-based authentication bypasses have also been added to their scanner toolkit, enhancing the tool's ability to identify and mitigate security threats.

Content Management Systems (CMS) facilitate collaboration between web development and marketing teams but can be vulnerable to cyberattacks due to their web application nature and widespread use. Companies often focus on securing main applications while overlooking CMS security, making them attractive targets for hackers who exploit technological vulnerabilities rather than content. A key decision in CMS adoption involves choosing between open-source and closed-source platforms, each with distinct security implications. Open-source CMS allows public access to source code, increasing vulnerability discovery chances, whereas closed-source CMS relies on internal security teams for testing. Security measures such as cleaning up plugins, scanning for vulnerabilities, and maintaining updated software versions are essential to mitigate risks. Plugins are particularly concerning due to potential vulnerabilities that can impact broader systems. Despite risks, open-source CMS options are generally secure with proactive security management, while SaaS-based CMS offers automated updates. Ensuring strong user access controls and incorporating CMS platforms into regular security routines are crucial for maintaining CMS security.