January 2019 Summaries

Detectify, an online security platform, updates its tool bi-weekly with new security findings from its research team and a community of ethical hackers. While not all updates can be disclosed due to confidentiality, recent enhancements include addressing vulnerabilities such as reflected XSS in Oracle Reports, SSRF in Adobe AEM, and directory traversal in SAP NetWeaver. Other issues tackled include XSS in Adobe AEM CQ Content-Finder, diagnostic endpoint exposure in Oracle Reports, and public exposure of sensitive files like WGET HSTS lists and .lesshst. Additionally, vulnerabilities in WordPress plugins, such as open redirects and configuration disclosures in Wordfence, have been addressed to enhance overall security. These updates ensure that Detectify's scanner tool remains robust against emerging threats.

Server Side Request Forgery (SSRF) is a security vulnerability that allows attackers to exploit a server's ability to make requests, often targeting internal systems behind a firewall. This vulnerability typically arises when user input is used to construct URLs that the server requests, such as in image import functions. An attacker can manipulate the input to make the server send requests to internal or external services, potentially accessing sensitive information or compromising the system. SSRF is challenging to prevent due to the complexity of URI syntax and the variety of protocols that can be exploited, making whitelisting a more effective defensive strategy than blacklisting. The vulnerability is increasingly concerning in cloud environments because it can facilitate unauthorized internal service interactions and lead to Remote Code Execution (RCE). Tools like Detectify help identify SSRF vulnerabilities by using Out-of-Band-Exploitation techniques to detect unauthorized server requests.

Detectify, a security tool, releases major updates every two weeks to incorporate new findings and improvements from their security researchers and the Crowdsource ethical hacker community. While not all updates can be disclosed due to confidentiality agreements, they are promptly integrated into the scanner for all users. Recent enhancements include addressing several vulnerabilities reported by ethical hackers, such as the Adobe ColdFusion unrestricted file upload, Joomla! JCK-Editor SQL injection, and Atlassian Jira route-based authentication bypass. Other vulnerabilities included default credentials in Nexus Sonatype, DOM XSS in response-proxy, and reflected XSS in Ghost CMS. These updates ensure the Detectify scanner remains effective and up-to-date in identifying security threats.

Alessandro, known as europa, is a white hat hacker from Italy who has been passionate about information security since the age of 12 and is now actively involved in bug bounty hunting on the Detectify Crowdsource platform. Despite being relatively new to the bug bounty scene, starting in 2017, he has leveraged his extensive background in infosec, including coding exploits and reverse engineering, to find and report vulnerabilities like SQL injections and XSS. His journey has been marked by persistence, especially in situations where his findings were initially marked as duplicates, leading him to develop more sophisticated methods and tools for bug hunting. Europa emphasizes the importance of continuous testing and automation in cybersecurity, which is why he values platforms like Detectify Crowdsource for their systematic approach to bug detection. He advises website owners to run bug bounty programs and avoid common pitfalls such as committing sensitive information to repositories, underscoring the importance of vigilance and respect in the cybersecurity field.