March 2019 Summaries

Detectify releases major security updates bi-weekly, incorporating new findings and improvements sourced from their security researchers and the Crowdsource ethical hacker community. These updates are immediately integrated into their scanner tool, although confidentiality agreements prevent full disclosure of all updates. Recently highlighted vulnerabilities include an Episerver GetGeoData API misconfiguration that could expose internal server IP addresses, a Jingo XSS flaw where older versions fail to escape HTML/JavaScript inputs, a Ruby on Rails file disclosure vulnerability allowing attackers to read local files, and a WordPress vulnerability that, when combined with a CSRF attack, increases the risk of unauthorized remote code execution.

Apache Struts is a widely used Java-based web application framework, particularly in enterprise settings, with a notable history of security vulnerabilities. A search on MITRE reveals numerous Common Vulnerabilities and Exposures (CVEs) related to Apache Struts, many of which involve OGNL (Object-Graph Navigation Language) expression injection, akin to Server Side Template Injection attacks. The framework's security challenges were highlighted by the infamous Equifax breach, which exploited CVE-2017-5638. Apart from OGNL vulnerabilities, Apache Struts also suffers from deserialization vulnerabilities, a known issue in Java due to its potential to allow execution of arbitrary code. Detectify offers testing services to identify OGNL expression injections and other known issues in Apache Struts, providing a tool for organizations to secure their applications against these vulnerabilities.

Detectify, a Swedish company specializing in domain and web application security, is expanding its operations to the United States by opening a new office in Boston, Massachusetts, aiming to capitalize on its significant revenue growth and existing US customer base. Founded in 2013 by expert ethical hackers, Detectify employs automation to scan web applications for security vulnerabilities, leveraging a network of white-hat hackers who contribute their findings to enhance the company’s security testing capabilities. With backing from investors such as Insight Venture Partners, Detectify has grown to over 60 employees and serves high-profile customers like Spotify and Trello. The company's expansion into the US, led by Wilder Parks III, seeks to deepen market understanding and cater to the growing demand for advanced security solutions, emphasizing a proactive and educational approach to cybersecurity. Detectify’s CEO, Rickard Carlsson, highlights the US as a hub of security-conscious organizations, making it an ideal location for enhancing the company's local presence and accelerating growth.

Cross-site scripting (XSS) is a vulnerability that occurs when attackers inject malicious JavaScript into a website, affecting its visitors by potentially accessing their cookies and sensitive information or altering the content they see. The text explores three types of XSS attacks: Reflected XSS, where the payload is reflected in the server's response and often requires tricking users into clicking a malicious link; Stored or Persistent XSS, where the payload is saved on the website, allowing it to affect users without needing them to click a specific link; and DOM XSS, where the attack is executed through the manipulation of the Document Object Model by existing JavaScript on the page, sometimes requiring a specific link to exploit but potentially having an impact similar to Persistent XSS if triggered by server actions. The text emphasizes the importance of scanning for vulnerabilities like XSS using tools such as Detectify, which offers a free trial to assess website security.

EdOverflow is a prominent figure in the cybersecurity community, known for his contributions like the security.txt standard, which simplifies the process for security researchers to find vendor contact details for responsible disclosures. He emphasizes the importance of understanding the legal aspects of coordinated disclosure and has been influenced by initiatives such as #legalbugbounty. EdOverflow is motivated by the opportunity to test his skills, receive feedback, and create useful tools that he and others might need, often sharing his work on platforms like GitHub. He advises aspiring hackers to become problem solvers, engage with open-source projects, and maintain a healthy work-life balance. Through platforms like Detectify Crowdsource, he finds financial and professional benefits in sharing vulnerabilities, even when no bounties are offered, emphasizing the importance of community engagement and networking in the security industry.

Server architecture is categorized into on-premises, cloud, and serverless, each with distinct characteristics affecting security responsibilities. On-premises involves physical servers owned by a company, granting full control but requiring comprehensive security management, including updates and hardware maintenance. Cloud computing offers virtual servers hosted by providers like Amazon or Google, relieving users of hardware upkeep but still necessitating software updates and security measures. Serverless, a subset of cloud solutions, operates on a Function as a Service (FaaS) model, where code is triggered by events without the need for dedicated server management. Despite these differences, users remain responsible for the security of their applications across all architectures. Detectify aids in securing web applications by regularly updating its vulnerability tests and adapting to different hosting environments, though it operates from its own infrastructure rather than offering an on-premises solution.

Detectify regularly updates its security tool every two weeks with new findings and improvements sourced from its security researchers and the Crowdsource ethical hacker community, ensuring that users have access to the latest security measures. While specific details of all updates cannot be disclosed due to confidentiality agreements, notable vulnerabilities addressed include Jenkins RCE, Nexus Repository Manager RCE, Next.js Path Traversal, Apache Airflow exposure, Craft CMS full path and log disclosures, and FastCGI test page exposure. These vulnerabilities highlight risks such as remote code execution and unauthorized data access, emphasizing the importance of maintaining robust security practices and configurations in web applications and related technologies.